Go to developer

Partner 2FA / Start authentication challenge

Start authentication challenge

POST/v1/auth/challenge

Creates a login challenge for an enrolled identity. Present challengeUrl to the user, then poll until approved.

Authentication

SERVER ONLY

Bearer clientId:clientSecret — Server secret required.

Request

Request body

Content-Type: application/json · required

  • externalUserIdstringrequired
  • noncestringnullable
  • projectIdstring (uuid)required
  • returnUrlstringnullable

    Optional URL; origin must match project callback URL origin

Response

201 Challenge created

  • challengeIdstringrequired
  • challengeUrlstringrequired
  • expiresInintegerrequired
  • pollAfterMsintegerrequired
  • returnUrlstringnullable
  • statusstringrequired

404 Not enrolled

  • detailsobject
  • errorstringrequired
  • messagestringrequired

Errors

ErrorHTTPMeaningFix
not_enrolled404No active identity for this userRun enrollment before starting a challenge Diagnose →

SDK equivalent

Examples

Bash
curl -X POST "https://auth.keyra.ie/v1/auth/challenge" \
  -H "Authorization: Bearer CLIENT_ID:CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"projectId":"11111111-1111-1111-1111-111111111111","externalUserId":"user_12345"}'

Response

response.jsonJSON
{
  "challengeId": "string",
  "challengeUrl": "string",
  "expiresIn": 0,
  "pollAfterMs": 0,
  "status": "string",
  "returnUrl": "https://example.com/app/return"
}