---
title: "Start SCA factor enrollment"
method: POST
path: "/sca/factors"
tags: ["Strong Customer Authentication"]
---

# Start SCA factor enrollment

`POST /sca/factors`

Begin enrolling an SCA factor for the customer. Enrollment covers the
explicit, opt-in factors a customer chooses to add — the request body's
`type` selects `TOTP` or `PASSKEY`. Returns the factor-specific material
needed to finish via `POST /sca/factors/confirm`.

`SMS_OTP` is implicit and is not enrolled through this endpoint. Every
customer in an SCA-regulated region has a verified phone number from
customer creation (via the Contact Verification flows —
`POST /customers/{customerId}/verify-phone` and `.../verify-phone/confirm`),
so SMS is always available as a factor with no extra setup and appears
among the customer's enrolled factors in `GET /sca/factors`.

A customer may have **only one passkey**. Starting a passkey enrollment when
one is already enrolled returns `409` (`PASSKEY_ALREADY_ENROLLED`) — delete it
via `DELETE /sca/factors/{credentialId}` first.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

## Request body

- union — Which SCA factor to begin enrolling, selected by `type`. `SMS_OTP` is not enrollable (it uses the customer's verified phone), so only `TOTP` and `PASSKEY` are valid here.
  - TotpFactorEnrollRequest — Start enrolling a time-based one-time-password (TOTP) authenticator factor.
    - `type` 'TOTP', required — Discriminator selecting the TOTP factor. TOTP enrollment needs no other input at start.
  - PasskeyFactorEnrollRequest — Start enrolling a WebAuthn passkey factor.
    - `type` 'PASSKEY', required — Discriminator selecting the passkey factor. Passkey enrollment needs no other input at start.

## Response `200`

Enrollment started; the factor-specific completion material is returned.

- union — The factor-specific material needed to complete enrollment, keyed by `type`: a TOTP shared secret + provisioning URI, or the WebAuthn registration options for a passkey.
  - TotpEnrollmentStart — The shared secret a customer's authenticator app needs to enroll a TOTP factor. Returned by `POST /sca/factors` for a `TOTP` request; the customer scans `totpUri` (an `otpauth://` provisioning URI) and confirms with the first code their app produces.
    - `type` 'TOTP', required — Discriminator identifying this as the TOTP enrollment-start payload.
    - `secret` string, required — The raw TOTP shared secret.
    - `secretBase32Encoded` string, required — The Base32-encoded shared secret, suitable for manual entry into an authenticator app that does not scan QR codes.
    - `totpUri` string, required — The `otpauth://` provisioning URI (the QR-code payload) the customer's authenticator app scans to enroll the factor.
  - PasskeyEnrollmentStart — Opaque WebAuthn registration options relayed to the end user's device to enroll a passkey factor. Grid performs no crypto; pass `options` to the device's WebAuthn API to produce a credential, then submit that credential to the confirm endpoint unmodified.
    - `type` 'PASSKEY', required — Discriminator identifying this as the passkey enrollment-start payload.
    - `options` object, required — Opaque WebAuthn `PublicKeyCredentialCreationOptions`. Pass to the device's WebAuthn registration API unmodified.
    - `allowedOrigins` string[], required — The origins the WebAuthn registration ceremony may run against. The origin the credential is produced against must be one of these and must be echoed back on the confirm call.
    - `relyingPartyId` string, required — The WebAuthn relying-party id the credential is bound to.

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `404` — Customer not found
- `409` — SCA is not required for this customer (`CONFLICT`), or a passkey enrollment was requested while one is already enrolled (`PASSKEY_ALREADY_ENROLLED`) — only one passkey per customer is supported.
- `500` — Internal service error

---

[API](https://skmtc.net/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.net/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/151f2d9bad9c/schema)