# Perform Verified Token Binding and Unbinding
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/3rdparty_authentication_scof/step3/index.md

## Step 3: Perform Verified Token Binding {#step-3-perform-verified-token-binding}

Mastercard provides the capability to bind a token to an MFA method. Once the binding is performed, a returning consumer using the same card on a merchant's website can be easily authenticated in the subsequent transactions using the bound MFA method.

This is also a key requirement in providing fraud liability protection to Integrators.

## Binding a Verified Token to a Consumer Device {#binding-a-verified-token-to-a-consumer-device}

An Integrator must perform the binding between the token (associated to a PAN) and the MFA method (linked to a consumer device), within **five** minutes of the ID\&V. Following are the **pre-requisites**:

* Authenticate a cardholder using an approved ID\&V method by the Issuer and share the results in `assuranceData` object - this is initiated by Integrator.
* Successfully enroll an MFA method - this is performed by [Authenticating Entity](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/third-party-authentication/authenticating-entity/index.md).
  * An [Authenticating Entity](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/token-authentication/third-party-authentication/authenticating-entity/index.md) must create signed `bindingAssertionJWT` and `mfaMethod` objects and provide this information to the Integrator.

<br />

An Integrator uses the \[Bind\](/documentation/api-reference/apis/#authentication) API to create a binding between the verified token and an instance of the MFA method linked to the consumer's device.

* The reference to the verified token is `srcDigitalCardId`
* The reference to the MFA method is the MFA method Instance Identifier (`mfaMethodInstanceId` or `externalMfaMethodInstanceId`).

Note: You must use a unique MFA method Instance Identifier (`mfaMethodInstanceId` or `externalMfaMethodInstanceId`) for each bind request per card/token.   
If not, during the unbind request, Mastercard Checkout Solutions unbinds all the cards/tokens associated with the MFA method Instance Identifier. Diagram taf-token-binding

Detailed steps are explained below:

1. After successful MFA method authentication, Authenticating Entity generates the `bindingAssertionJWT` as part of `assuranceData` object and provides it to the Integrator.
2. An Integrator sends the [Bind](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) API request with the `srcClientId`, `bindingAssertionJWT`, `assuranceData` and `mfaMethod` values. Tip: Learn more about `bindingAssertionJWT` in this [section](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/token-auth-framework/authenticating-entity/index.md#generating-bindingAssertionjwt).
3. Mastercard Checkout Solutions processes the request, performs the MFA ID binding with the verified token and returns the `externalMfaMethodInstanceId` / `mfaMethodInstanceId` to the Integrator.

## Unbinding a Verified Token from a Consumer Device {#unbinding-a-verified-token-from-a-consumer-device}

Use [Delete MFA](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) API to delete the binding between a verified token and an MFA method instance when a consumer no longer wants to use a MFA method with that card on a device.
Diagram taf-token-unbinding

Detailed steps are explained below:

1. An Integrator sends the [Delete MFA](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#authentication) request with the `srcClientId`, `mfaIdType`, `externalMfaMethodInstanceId` or `mfaMethodInstanceId` values.
2. Mastercard Checkout Solutions processes the request, deletes the MFA method ID binding with the verified token and returns the `externalMfaMethodInstanceId` or `mfaMethodInstanceId` to the Integrator.