Skip to main content
POST
Complete an SCA login

Authorizations

Authorization
string
header
required

API token authentication using format <api token id>:<api client secret>

Query Parameters

customerId
string
required

The unique identifier of the customer completing an SCA login.

Body

application/json

Completes an SCA login by submitting the proof for the started factor. Carries the same proof fields as an ScaAuthorization (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), plus the factor being completed, the endUserIpAddress the login is being performed from, and, for SMS_OTP, the challengeId returned by the login start.

factor
enum<string>
required

The factor being completed; must match the started login.

Available options:
SMS_OTP,
TOTP,
PASSKEY
endUserIpAddress
string
required

The IP address of the end user's device completing this login, recorded against the login event by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment and any transaction-risk exemption.

Example:

"203.0.113.42"

code
string | null
required

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 123456.

Example:

"123456"

challengeId
string | null

The challenge handle returned by the login start, required for SMS_OTP and omitted for other factors.

passkeyAssertion
object | null

Opaque WebAuthn assertion produced by the device from the login start's passkeyOptions. Required when completing a PASSKEY login.

origin
string | null

The WebAuthn origin the passkeyAssertion was produced against (one of the login start's allowedOrigins). Required alongside passkeyAssertion; omit it for the code path.

Example:

"https://app.example.com"

Response

SCA login completed; the session status is returned.

The status of a completed SCA login session.

status
string
required

The status of the login session. A successful login reports SUCCESS; other values indicate the login did not complete and should be surfaced to the caller.

Example:

"SUCCESS"

sessionExpiresAt
string<date-time> | null

Absolute UTC timestamp after which the customer's SCA session is no longer valid and they must complete another SCA login. Money movement in SCA-regulated currencies is refused once it passes, so prompt a re-login ahead of it rather than waiting for a SCA_SESSION_REQUIRED failure. Present when the login established a session.

Example:

"2026-01-29T12:00:00Z"