Complete an SCA login

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/login/complete \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456",
  "challengeId": "<string>",
  "passkeyAssertion": {},
  "origin": "https://app.example.com"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    code: '123456',
    challengeId: '<string>',
    passkeyAssertion: {},
    origin: 'https://app.example.com'
  })
};

fetch('https://api.lightspark.com/grid/2025-10-13/sca/login/complete', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"code\": \"123456\",\n  \"challengeId\": \"<string>\",\n  \"passkeyAssertion\": {},\n  \"origin\": \"https://app.example.com\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/sca/login/complete")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "status": "SUCCESS"
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 423,
  "code": "ACCOUNT_LOCKED",
  "message": "<string>",
  "details": {
    "suspended": true,
    "lockedUntil": "2023-11-07T05:31:56Z",
    "failedAttempts": 123
  }
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Strong Customer Authentication

Complete an SCA login

Finalize an SCA login by submitting the proof for the started factor (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId for SMS_OTP. Returns the reported session status.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 123456.

POST

sca

complete

Complete an SCA login

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/login/complete \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456",
  "challengeId": "<string>",
  "passkeyAssertion": {},
  "origin": "https://app.example.com"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    code: '123456',
    challengeId: '<string>',
    passkeyAssertion: {},
    origin: 'https://app.example.com'
  })
};

fetch('https://api.lightspark.com/grid/2025-10-13/sca/login/complete', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"code\": \"123456\",\n  \"challengeId\": \"<string>\",\n  \"passkeyAssertion\": {},\n  \"origin\": \"https://app.example.com\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/sca/login/complete")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "status": "SUCCESS"
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 423,
  "code": "ACCOUNT_LOCKED",
  "message": "<string>",
  "details": {
    "suspended": true,
    "lockedUntil": "2023-11-07T05:31:56Z",
    "failedAttempts": 123
  }
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Authorizations

Authorization

string

header

required

API token authentication using format <api token id>:<api client secret>

Query Parameters

customerId

string

required

The unique identifier of the customer completing an SCA login.

Body

application/json

Option 1
Option 2

Completes an SCA login by submitting the proof for the started factor. Carries the same proof fields as an ScaAuthorization (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), plus the factor being completed and, for SMS_OTP, the challengeId returned by the login start.

factor

enum<string>

required

The factor being completed; must match the started login.

Available options:

SMS_OTP,

TOTP,

PASSKEY

code

string | null

required

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 123456.

Example:

"123456"

challengeId

string | null

The challenge handle returned by the login start, required for SMS_OTP and omitted for other factors.

passkeyAssertion

object | null

Opaque WebAuthn assertion produced by the device from the login start's passkeyOptions. Required when completing a PASSKEY login.

origin

string | null

The WebAuthn origin the passkeyAssertion was produced against (one of the login start's allowedOrigins). Required alongside passkeyAssertion; omit it for the code path.

Example:

"https://app.example.com"

Response

SCA login completed; the session status is returned.

The status of a completed SCA login session.

status

string

required

The status of the login session, passed through verbatim (Grid does not normalize it). A successful login reports SUCCESS; other values indicate the login did not complete and should be surfaced to the caller.

Example:

"SUCCESS"

Start an SCA login

Record a security event

⌘I

Using the API

API documentation

Complete an SCA login

Authorizations

Query Parameters

Body

Response