---
title: "Complete unified SCA login"
method: POST
path: "/user/login/complete"
tags: ["Login"]
---

# Complete unified SCA login

`POST /user/login/complete`

Submits the factor-specific proof and, on success, grants a new 180-day SCA session. Any prior active session for this user is revoked. — Required body fields per factor: `sms` needs `challengeId` and `code` (6-digit numeric); `totp` needs `code` (6 numeric digits or `XXXXX-XXXXX` recovery code); `passkey` needs `origin` and `credential`.

## Request body

- object
  - `userId` string, required
  - `verificationMethod` 'sms' | 'totp' | 'passkey', required
  - `ip` string, required — Client IP address, recorded with the login event for audit purposes.
  - `challengeId` string — Required for `sms`.
  - `code` string — 6-digit OTP for `sms` / 6 digits or recovery code for `totp`.
  - `origin` string — Required for `passkey` — the browser-supplied origin.
  - `credential` object — WebAuthn `PublicKeyCredential` from `navigator.credentials.get()`. Required for `passkey`.
    - `id` string
    - `rawId` string
    - `type` string
    - `response` object
      - `clientDataJSON` string
      - `authenticatorData` string
      - `signature` string
      - `userHandle` string
    - `clientExtensionResults` object — WebAuthn client extension results.
      - `appid` string — Optional appid extension result.

## Response `200`

Login complete. SCA session granted.

- object
  - `status` string, required

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)