A method for authenticating a login request received by a provider server from a client agent, the method comprising: receiving from the provider server an identity assertion request associated with the login request; receiving an identity identifier for an identity associated with the identity assertion request; in response to receiving the identity assertion request and the identity identifier, identifying a client device separate from the client agent and associated with the identity identifier and the provider server; sending a validation request to the client device; and characterised in that the method further comprises prior to the identifying and the sending steps: receiving a request to associate the client device with the identity identifier; determining an identity proofing criterion based upon a primary credential; generating an identity proofing request for an identity proofing response that satisfies the identity proofing criterion; sending the identity proofing request to the client device; receiving the identity proofing response from the client device in response to the identity proofing request; and in response to the identity proofing response satisfying the identity proofing criterion, storing a record of the client device and the association of the client device with the identity identifier and the provider server. receiving from the provider server an identity assertion request associated with the login request; receiving an identity identifier for an identity associated with the identity assertion request; in response to receiving the identity assertion request and the identity identifier, identifying a client device separate from the client agent and associated with the identity identifier and the provider server; sending a validation request to the client device; and characterised in that the method further comprises prior to the identifying and the sending steps: receiving a request to associate the client device with the identity identifier; determining an identity proofing criterion based upon a primary credential; generating an identity proofing request for an identity proofing response that satisfies the identity proofing criterion; sending the identity proofing request to the client device; receiving the identity proofing response from the client device in response to the identity proofing request; and in response to the identity proofing response satisfying the identity proofing criterion, storing a record of the client device and the association of the client device with the identity identifier and the provider server. receiving a request to associate the client device with the identity identifier; determining an identity proofing criterion based upon a primary credential; generating an identity proofing request for an identity proofing response that satisfies the identity proofing criterion; sending the identity proofing request to the client device; receiving the identity proofing response from the client device in response to the identity proofing request; and in response to the identity proofing response satisfying the identity proofing criterion, storing a record of the client device and the association of the client device with the identity identifier and the provider server.