NFC how-to

Scan once. Provision new tags or verify existing ones.

The operator follows the same scan procedure in both cases. The app inspects the secure Type 4 tag and decides whether to provision its factory key or authenticate its existing diversified key.

Scan a tag

Sign in as the intended operator.The app compares the operator ID on an existing tag with the subject of this account's authentication token.
Open Device Control.Select NFC Tag Scan. The scan screen enables reader mode while it remains in the foreground.
Position the phone.Hold the NFC antenna close to the tag. Keep the phone steady and do not remove it after the first sound or vibration.
Wait for the result screen.APDU exchanges and a possible backend key lookup must finish while the tag remains in the RF field.
Read the outcome.Only Authentication successful means the tag was provisioned or verified for the signed-in operator.

Provisioning changes the tag. A factory-fresh tag receives an operator binding and a new diversified master key. Scan only approved inventory and do not interrupt the phone while provisioning is in progress.

Behind the tap

What happens during the scan

One tap follows the same trusted sequence at the start. The app then either prepares a factory-fresh tag or verifies a tag that is already assigned.

1
DiscoverReader mode finds the nearby tag.
2
InspectThe app identifies the secure tag and processor.
3
SecureThe app provisions or authenticates the tag.
4
ConfirmThe verified result is shown to the operator.

First use

Factory-fresh tag

1
The app connects over ISO-DEP, selects the secure application, and reads chip information.
2
An EV2 First exchange tests the factory-default AES key.
3
The backend derives a tag-specific 128-bit master key using the tag and mobile-device data.
4
The app writes the signed-in operator ID to tag file 2 and changes that file to Full secure messaging.
5
The app caches the diversified key in encrypted Android preferences and replaces tag key slot 0.

Returning use

Previously provisioned tag

1
The app starts EV2 First authentication and loads the diversified key from encrypted preferences or the backend.
2
The phone and tag prove knowledge of the key and derive per-session encryption and MAC keys.
3
The app securely reads the operator ID from file 2. A legacy clear-mode file is migrated after reauthentication.
4
The scan succeeds only when cryptographic authentication succeeds and the stored operator ID matches the signed-in operator.

Understand the result

Field	Meaning
Authentication status	The authoritative success or failure result. It includes operator ownership for an existing tag.
Operator	The signed-in operator name and the operator ID read from or written to the tag.
Response status	The final two-byte card status and its protocol meaning, when the tag returned one.
Secure session	Whether transaction and session-key data were established for secure messaging.
Read counter and transaction ID	Protocol diagnostics captured during introspection and authentication.
Tag details	UID, manufacturer, hardware/software versions, storage, protocol, technologies, batch, and production date when available.

A result can contain useful tag details and still be unverified. Do not use the presence of a UID, transaction ID, or successful low-level status as a substitute for the authentication status.

Technology routing and compatibility

The scan screen enables reader mode for NFC-A, NFC-B, NFC-F, NFC-V, and barcode technologies, but secure device authentication requires an ISO-DEP tag that resolves to a registered processor. The implementation currently provides processor classes for NTAG 424 DNA and MIFARE DESFire EV3 workflows.

Reader mode skips Android's normal NDEF check to prioritize direct ISO-DEP communication. A separate legacy branch can write, lock, and ship NDEF data when Android has already exposed an NDEF or NDEF-formatable tag; that branch does not produce a verified secure-tag result.

← User guide Next: FAQ →