Hi @lillian.li
Thank you for your patience on this!
It appears that CIBA should allow the use-case that you described, as most of the " heavy lifting " will need to be processed via backend process which handles the online payment part. A workflow will need to be implemented that works something along the following lines :
- perform a check of the user’s authentication factors;
- if the target user does have Guardian with push enrolled, submit the CIBA request;
- otherwise, take the user to an inline process with Guardian (QR, manual code entry). Then submit the CIBA request.
Although arguably this flow can potentially defeat part of the safety that CIBA was implemented with in mind, it should still be supported after confirming internally.
Hope this helped!
Gerald