Sign in

v5

OpenAPI 3.1.0Proprietary2026-08-011476181.4 MB
Strong Customer Authentication

Start an SCA login

Begin an SCA login for the customer with the chosen factor, opening the end-user SCA session (an exemption gating read / account access beyond the per-transaction window). Returns factor-specific material: SMS_OTP dispatches a code and returns a challengeId + expiresAt; TOTP returns only the factor (the customer reads the code from their app); PASSKEY returns WebAuthn passkeyOptions. Complete with POST /sca/login/complete.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

post/sca/login/start

Request body

factor'SMS_OTP' | 'TOTP' | 'PASSKEY' required

A Strong Customer Authentication factor.

FactorDescription
SMS_OTPOne-time code sent by SMS to the customer's verified phone. Requires no prior enrollment.
TOTPTime-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking).
PASSKEYWebAuthn passkey assertion. Requires enrollment.

Response

SCA login started; factor-specific material is returned.

factor'SMS_OTP' | 'TOTP' | 'PASSKEY' required

A Strong Customer Authentication factor.

FactorDescription
SMS_OTPOne-time code sent by SMS to the customer's verified phone. Requires no prior enrollment.
TOTPTime-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking).
PASSKEYWebAuthn passkey assertion. Requires enrollment.
challengeIdstring nullable

The challenge handle for an SMS_OTP login, threaded back on the complete call. Present only for SMS_OTP.

expiresAtstring date-time nullable

Absolute UTC timestamp after which the SMS_OTP code expires. Present only for SMS_OTP.

passkeyOptionsobject nullable

Opaque WebAuthn assertion request options. Present only for PASSKEY; pass to the device's WebAuthn API to produce the assertion submitted on the complete call.

allowedOriginsstring[] nullable

The origins the WebAuthn ceremony may run against. Present only for PASSKEY.

relyingPartyIdstring nullable

The WebAuthn relying-party id. Present only for PASSKEY.

Example response

{
  "expiresAt": "2025-10-03T12:05:00Z",
  "allowedOrigins": [
    "https://app.example.com"
  ],
  "relyingPartyId": "app.example.com"
}