Sign in

v1

latestOpenAPI 3.0.12026-07-245303882.5 MB
JSR Payment Initiation (Journey without Redirection)

Get parameters for FIDO2 authentication.

Endpoint to obtain the required parameters for FIDO2 authentication using previously registered credentials during Open Finance Brasil payment operations. This method generates a unique challenge for each call and returns parameters compatible with the WebAuthn navigator.credentials.get() API for verifying digital signatures. The enrollment must be in AUTHORISED status with valid associated FIDO2 credentials. Used in Journey without Redirection (JSR) for strong authentication before authorizing payment transactions.

post/open-keys/itp/api/v2/enrollments/v2/payment-initiation/{itp_enrollment_id}/fido-sign-options

Path parameters

itp_enrollment_idstring required

Request body

journeySessionIdstring

ID is the unique identifier of journey

paymentInitiationIdstring

Unique identifier of the payment initiation for which FIDO2 authentication is requested. Required when using API scope to link the authentication to a specific payment operation.

Example request

{
  "journeySessionId": "f362a873-c127-4122-b711-a37b24a36914",
  "paymentInitiationId": "f362a873-c127-4122-b711-a37b24a36914",
  "data": {
    "platform": "ANDROID"
  }
}

Response

Object containing the necessary information for signing with a FIDO2 credential.

challengestring required

Random byte sequence generated by the FIDO2 server for this authentication request. Must be the value in base64url format without padding. This challenge is cryptographically unique for each authentication attempt and must be signed by the user's private key to prove possession of the credential.

timeoutinteger

Timeout in milliseconds for completing the FIDO2 authentication. Specifies how long the user has to complete the authentication process before the challenge expires. Common values range from 30000 (30 seconds) to 300000 (5 minutes).

userVerificationstring

Level of user verification required for this FIDO2 authentication. Values: 'required' (user verification must occur), 'preferred' (user verification is preferred but not required), 'discouraged' (user verification should not occur). User verification typically involves biometrics, PIN, or other local authentication methods on the device.

rpIdstring

Relying Party identifier for FIDO2 authentication origin validation. Must match the domain or identifier used during credential registration. This ensures that credentials can only be used for the intended service and prevents unauthorized cross-origin usage.

Example response

{
  "challenge": "SA03whJqfB7rWRiaEh6dyLNm3Wg4EY7H50g9b1XCMBw",
  "allowCredentials": [
    {
      "id": "xf1k_8KzydfqRMxvchl0axbwZINYaDGmYNvHldVnT6Mmmil1",
      "type": "public-key"
    }
  ],
  "timeout": 60000,
  "userVerification": "preferred",
  "rpId": "webauthn-simulator.web.app"
}