Start an SCA login

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/login/start \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://api.lightspark.com/grid/2025-10-13/sca/login/start', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/sca/login/start")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "challengeId": "<string>",
  "expiresAt": "2025-10-03T12:05:00Z",
  "passkeyOptions": {},
  "allowedOrigins": [
    "https://app.example.com"
  ],
  "relyingPartyId": "app.example.com"
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Strong Customer Authentication

Start an SCA login

Begin an SCA login for the customer with the chosen factor, opening the end-user SCA session (an exemption gating read / account access beyond the per-transaction window). Returns factor-specific material: SMS_OTP dispatches a code and returns a challengeId + expiresAt; TOTP returns only the factor (the customer reads the code from their app); PASSKEY returns WebAuthn passkeyOptions. Complete with POST /sca/login/complete.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

POST

sca

start

Start an SCA login

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/login/start \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '{}'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({})
};

fetch('https://api.lightspark.com/grid/2025-10-13/sca/login/start', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/sca/login/start")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "challengeId": "<string>",
  "expiresAt": "2025-10-03T12:05:00Z",
  "passkeyOptions": {},
  "allowedOrigins": [
    "https://app.example.com"
  ],
  "relyingPartyId": "app.example.com"
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Authorizations

Authorization

string

header

required

API token authentication using format <api token id>:<api client secret>

Query Parameters

customerId

string

required

The unique identifier of the customer starting an SCA login.

Body

application/json

Selects which enrolled factor to start an SCA login with. The factor must already be enrolled (or, for SMS_OTP, the phone verified).

factor

enum<string>

required

The factor to authenticate with.

Available options:

SMS_OTP,

TOTP,

PASSKEY

Response

SCA login started; factor-specific material is returned.

The factor-specific material a customer needs to complete an SCA login. Each factor surfaces only the fields it issues: SMS_OTP carries challengeId and expiresAt; TOTP carries neither (the customer reads the code from their authenticator app); PASSKEY carries the opaque WebAuthn passkeyOptions with allowedOrigins and relyingPartyId.

factor

enum<string>

required

The factor this login was started for.

Available options:

SMS_OTP,

TOTP,

PASSKEY

challengeId

string | null

The challenge handle for an SMS_OTP login, threaded back on the complete call. Present only for SMS_OTP.

expiresAt

string<date-time> | null

Absolute UTC timestamp after which the SMS_OTP code expires. Present only for SMS_OTP.

Example:

"2025-10-03T12:05:00Z"

passkeyOptions

object | null

Opaque WebAuthn assertion request options. Present only for PASSKEY; pass to the device's WebAuthn API to produce the assertion submitted on the complete call.

allowedOrigins

string[] | null

The origins the WebAuthn ceremony may run against. Present only for PASSKEY.

Example:

["https://app.example.com"]

relyingPartyId

string | null

The WebAuthn relying-party id. Present only for PASSKEY.

Example:

"app.example.com"

Delete an enrolled SCA factor

Complete an SCA login

⌘I

Using the API

API documentation

Start an SCA login

Authorizations

Query Parameters

Body

Response