---
title: "Confirm SCA factor enrollment"
method: POST
path: "/sca/factors/confirm"
tags: ["Strong Customer Authentication"]
---

# Confirm SCA factor enrollment

`POST /sca/factors/confirm`

Finalize the factor enrollment started by `POST /sca/factors`. The request
body is discriminated by `type`: for `TOTP`, submit the shared `secret` from
the start call plus the first `code`; for `PASSKEY`, submit the WebAuthn
`credential` the device produced plus the `origin` it was produced against.
The threaded secret/credential binds the confirmation to its enrollment, so
no separate id is needed.

A TOTP confirmation returns one-time recovery codes (shown once); a passkey
confirmation returns the enrolled factor.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

In sandbox, the TOTP code is always `123456`.

## Request body

- union — The proof that finalizes enrollment, keyed by `type`: the TOTP shared secret + code, or the passkey `origin` + `credential`.
  - TotpEnrollmentConfirmRequest — The shared secret returned by the TOTP enrollment start, plus the first code the customer's authenticator app produces, submitted to confirm and finalize the TOTP factor.
    - `type` 'TOTP', required — Discriminator selecting the TOTP confirm variant.
    - `secret` string, required — The shared secret returned as `secret` by the TOTP enrollment start, threaded back to bind the confirmation to that enrollment.
    - `code` string, required — The current time-based one-time code from the customer's authenticator app. In sandbox, the code is always `123456`.
  - PasskeyEnrollmentConfirmRequest — The WebAuthn credential a device produced for a passkey registration challenge, submitted to enroll the passkey factor.
    - `type` 'PASSKEY', required — Discriminator selecting the passkey confirm variant.
    - `origin` string, required — The WebAuthn origin the `credential` was produced against (one of the enrollment start's `allowedOrigins`).
    - `credential` object, required — Opaque WebAuthn credential the device produced from the enrollment start's `options`.

## Response `200`

Factor enrolled; the factor-specific result is returned.

- union — The enrollment result, keyed by `type`.
  - TotpEnrollmentConfirmResponse — The one-time recovery codes issued once a TOTP factor is enrolled. These are shown to the customer only once; store them somewhere safe to recover access if the authenticator device is lost.
    - `type` 'TOTP', required — Discriminator identifying this as the TOTP enrollment result.
    - `recoveryCodes` string[], required — The one-time recovery codes for this TOTP factor.
  - PasskeyEnrollmentConfirmResponse — The enrolled passkey factor returned after a successful confirmation.
    - `type` 'PASSKEY', required — Discriminator identifying this as the passkey enrollment result.
    - `factor` ScaFactorView, required — An enrolled Strong Customer Authentication factor.
      - `factor` 'SMS_OTP' | 'TOTP' | 'PASSKEY', required — A Strong Customer Authentication factor. | Factor | Description | |--------|-------------| | `SMS_OTP` | One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment. | | `TOTP` | Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking). | | `PASSKEY` | WebAuthn passkey assertion. Requires enrollment. |
      - `credentialId` string — The per-credential id, populated only for `PASSKEY` factors (the id passed to delete a passkey). Omitted for `TOTP` and `SMS_OTP`, which have no per-credential id.
      - `name` string — An optional human-readable label for this factor.

## Other responses

- `400` — Invalid or incorrect confirmation proof
- `401` — Unauthorized
- `404` — Customer not found
- `409` — SCA is not required for this customer.
- `500` — Internal service error

---

[API](https://skmtc.net/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.net/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/151f2d9bad9c/schema)