Skip to main content
Version: 11.3.0

Add HYPR Passwordless Authentication to PingOne DaVinci Journeys

Purpose​

This playbook gives you the running order for integrating HYPR with PingOne DaVinci, so a DaVinci identity orchestration journey can invoke HYPR passwordless authentication and branch on the result.

Each step below is a summary. The detail — screenshots, field values, and reference tables — lives in PingOne DaVinci: OIDC Integration in CC, and each step links to the section that carries it.

Once the integration is in place you can add passwordless authentication to DaVinci journeys, reduce your reliance on passwords, verify users through their enrolled devices, and build journeys for step-up and risk-based authentication — while orchestration stays centralized in DaVinci.

Architecture​

The application calls DaVinci, DaVinci calls the HYPR Connector, and the connector calls your HYPR Control Center tenant. The user's HYPR Mobile App talks to Control Center directly to complete the authentication.

For the diagram and the eight-step request flow, see Integration Architecture.

Prerequisites​

You need a running PingOne DaVinci tenant with administrator access and the ability to create connectors and flows, plus a running HYPR Control Center tenant with administrator access and integration creation enabled.

For the full list, see Prerequisites.

Procedure​

Step 1 — Add the integration in the HYPR Control Center​

In Control Center, add a new PingOne DaVinci Identity Orchestration integration. You supply two values: an application name, which HYPR reuses in the DaVinci Admin Console, the Mobile App, and the Device Manager page; and the OIDC redirect URL list Ping gives you.

Decide the application name before you start — it is limited to 23 characters, strips spaces and special characters, and surfaces to users.

See Connecting PingOne DaVinci to HYPR, steps 1 to 5.

Step 2 — Collect the generated OIDC values​

Open the integration's Integration Settings tab. HYPR generates three values there — an OIDC client ID, an OIDC client secret, and a well-known endpoint URL. You need them in Step 3, so copy them before you move on.

See Connecting PingOne DaVinci to HYPR, step 6.

Step 3 — Create the HYPR Connector in PingOne DaVinci​

In the PingOne DaVinci Admin Console, add the HYPR connector from Connectors, then configure a connector instance with the values from Step 2.

Ping owns the authoritative connector deployment steps; the HYPR-side field mapping is summarized in our reference. See Adding the Connector and Configuring the Connector Instance.

Step 4 — Build the DaVinci authentication flow​

Import the Marketplace flow template as a starting point, then configure the HYPR Connector node. The node takes a username and returns the authentication and token response the rest of your flow branches on. Customize the flow from there as your journey requires.

See Building the Authentication Flow.

Step 5 — Enroll your users in HYPR​

The connector does not enroll users — it relies on enrollment state held by HYPR, and checks at authentication time that the user has an active enrollment and a registered device. So enrollment has to happen before anyone can authenticate through the journey.

This integration does not synchronize users from an identity provider. Enroll them from the Send Manually tab, individually or by CSV upload; either way the user receives a Magic Link to complete enrollment.

See Enrolling Yourself in the PingOne DaVinci Integration.

Step 6 — Enable the integration​

The integration stays Disabled until you enable it on the Integration Settings tab. Enabling it allows every user with a PingOne DaVinci account in your organization to authenticate with HYPR, and DaVinci can take a few minutes to pick up the change.

See Enabling the Integration.

Validate​

Prepare a test user first: create the HYPR user, enroll the HYPR Mobile App, confirm the device registered, and assign the user to the PingOne DaVinci integration.

Then run the journey end to end — enter the username, follow the redirect to HYPR, authenticate on the enrolled device, return to DaVinci, and confirm the flow completes.

See Validating the Integration.

Logs and audit trail​

Authentication activity for the integration is recorded in its Audit Trail tab in Control Center, which is where you confirm what happened during a test or diagnose a failing journey.

See Logs and Audit Trail for where to find it, and Audit Trail for the columns, filters, and export options.

See also​