# ciba

Source: https://startwithidentity.com/glossary/ciba/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call centers and decoupled approvals.

CIBA solves a real problem: the person who needs to approve is not at the device making the request. Call center verification, in-store payments, and machine-initiated transactions all fit. It is also the pattern that device-code phishing abuses, because decoupling the requesting device from the approving one is exactly what a phisher wants. Bind the approval prompt to transaction detail the user can check, and never let it read as a generic "approve sign-in".

See also: [OpenID Connect](https://startwithidentity.com/standards/openid-connect/), [device code flow](https://startwithidentity.com/glossary/device-code-flow/), [step-up auth](https://startwithidentity.com/glossary/step-up-auth/), [MFA](https://startwithidentity.com/glossary/mfa/)