Abstract: A first identity credential (for example, a username and password), in conjunction with a second identity credential (for example, a token identifier and a token-generated password) verified by an authentication provider, permits access to a protected resource (for example, a bank account) maintained by a service provider (for example, a bank) where the service provider is a separate entity from the authentication provider. Such separation of the service provider from the authentication provider allows multiple service providers to use the same authentication provider such that subscribers of services from multiple service providers may register a single authentication provider, and thus use a single method to produce the second identity credential. An authentication provider provides a common validation service to a plurality of unrelated service providers. An electronic user interface and a key-chain token for carrying out the authentication process are also disclosed.