Complete an SCA login
Finalize an SCA login by submitting the proof for the started factor
(code for SMS_OTP / TOTP, or passkeyAssertion + origin for
PASSKEY), echoing the challengeId for SMS_OTP. Returns the
reported session status.
This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.
In sandbox, the SMS/TOTP code is always 123456.
Authorizations
API token authentication using format <api token id>:<api client secret>
Query Parameters
The unique identifier of the customer completing an SCA login.
Body
- Option 1
- Option 2
Completes an SCA login by submitting the proof for the started factor. Carries the same proof fields as an ScaAuthorization (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), plus the factor being completed, the endUserIpAddress the login is being performed from, and, for SMS_OTP, the challengeId returned by the login start.
The factor being completed; must match the started login.
SMS_OTP, TOTP, PASSKEY The IP address of the end user's device completing this login, recorded against the login event by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment and any transaction-risk exemption.
"203.0.113.42"
The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 123456.
"123456"
The challenge handle returned by the login start, required for SMS_OTP and omitted for other factors.
Opaque WebAuthn assertion produced by the device from the login start's passkeyOptions. Required when completing a PASSKEY login.
The WebAuthn origin the passkeyAssertion was produced against (one of the login start's allowedOrigins). Required alongside passkeyAssertion; omit it for the code path.
"https://app.example.com"
Response
SCA login completed; the session status is returned.
The status of a completed SCA login session.
The status of the login session. A successful login reports SUCCESS; other values indicate the login did not complete and should be surfaced to the caller.
"SUCCESS"
Absolute UTC timestamp after which the customer's SCA session is no longer valid and they must complete another SCA login. Money movement in SCA-regulated currencies is refused once it passes, so prompt a re-login ahead of it rather than waiting for a SCA_SESSION_REQUIRED failure. Present when the login established a session.
"2026-01-29T12:00:00Z"