Sign in

v5

OpenAPI 3.1.0Proprietary2026-08-011476181.4 MB
Strong Customer Authentication

Confirm SCA factor enrollment

Finalize the factor enrollment started by POST /sca/factors. The request body is discriminated by type: for TOTP, submit the shared secret from the start call plus the first code; for PASSKEY, submit the WebAuthn credential the device produced plus the origin it was produced against. The threaded secret/credential binds the confirmation to its enrollment, so no separate id is needed.

A TOTP confirmation returns one-time recovery codes (shown once); a passkey confirmation returns the enrolled factor.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the TOTP code is always 123456.

post/sca/factors/confirm

Request body

OR

Example request

{
  "code": "123456"
}

Response

Factor enrolled; the factor-specific result is returned.

OR

Example response

{
  "recoveryCodes": [
    "ABCD-EFGH-IJKL",
    "MNOP-QRST-UVWX"
  ]
}