> ## Documentation Index > Fetch the complete documentation index at: https://docs.craveup.com/llms.txt > Use this file to discover all available pages before exploring further. # Consume a fresh code proof for a customer session ## OpenAPI ````yaml /generated/storefront.openapi.json post /merchant/{merchantSlug}/auth/challenges/{challengeId}/verify openapi: 3.0.3 info: title: Crave Storefront API version: 2.0.0 description: >- Direct public Storefront API. Anonymous catalog reads require no API key. Protected resources use purpose-limited cart, checkout, receipt, or customer credentials. contact: name: Crave Support email: hello@craveup.com servers: - url: https://api.craveup.com/api/v1/storefront description: Production Storefront API - url: https://sandbox-api.craveup.com/api/v1/storefront description: Sandbox Storefront API security: [] tags: - name: Customer Auth - name: Catering - name: Loyalty - name: Merchants - name: Locations - name: Ordering Sessions - name: Menus - name: Products - name: Carts - name: Analytics - name: Checkout - name: Cart Items - name: Discounts - name: Customers - name: Orders paths: /merchant/{merchantSlug}/auth/challenges/{challengeId}/verify: post: tags: - Customer Auth summary: Consume a fresh code proof for a customer session operationId: storefrontVerifyCustomerAuthChallenge parameters: - name: merchantSlug in: path required: true schema: type: string minLength: 1 maxLength: 128 - name: challengeId in: path required: true schema: type: string minLength: 1 maxLength: 128 - name: Idempotency-Key in: header required: true description: Caller-stable key reused only for retries of this exact request. schema: type: string minLength: 16 maxLength: 128 pattern: ^[A-Za-z0-9._:-]{16,128}$ requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CustomerAuthVerifyInput' responses: '200': description: Opaque customer session grant; no provider identity is exposed. content: application/json: schema: $ref: '#/components/schemas/CustomerAuthSessionGrant' headers: Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. '400': description: >- The request is invalid, or CUSTOMER_AUTH_CODE_REJECTED confirms a definitive verification rejection with no session grant. Only that code permits a corrected verification intent. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '401': description: Authentication or capability authorization is required. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '403': description: The authenticated principal does not own this resource. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '404': description: The requested resource was not found. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '409': description: The idempotency key or resource revision conflicts. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '429': description: The request was rate limited. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '500': description: An unexpected error occurred. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' '503': description: A required dependency is temporarily unavailable. headers: X-Request-Id: description: Opaque request identifier for support and telemetry correlation. schema: type: string Cache-Control: schema: type: string example: no-store description: Authentication responses must never be cached. content: application/json: schema: $ref: '#/components/schemas/CommerceErrorEnvelope' security: - StorefrontCustomerAuthIntent: [] StorefrontCustomerChallenge: [] components: schemas: CustomerAuthVerifyInput: type: object properties: code: type: string minLength: 1 maxLength: 128 required: - code additionalProperties: false CustomerAuthSessionGrant: type: object properties: sessionId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$ customerId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$ generation: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 accessExpiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$ refreshExpiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$ accessToken: $ref: '#/components/schemas/CustomerAuthSecret' refreshToken: $ref: '#/components/schemas/CustomerAuthSecret' required: - sessionId - customerId - generation - accessExpiresAt - refreshExpiresAt - accessToken - refreshToken additionalProperties: false CommerceErrorEnvelope: type: object properties: code: anyOf: - type: string enum: - VALIDATION_ERROR - UNAUTHORIZED - CUSTOMER_AUTH_CODE_REJECTED - FORBIDDEN - NOT_FOUND - RATE_LIMITED - CART_CONFLICT - REQUOTE_REQUIRED - RESOURCE_CONFLICT - CART_IMMUTABLE - IDEMPOTENCY_KEY_REQUIRED - IDEMPOTENCY_KEY_REUSED - IDEMPOTENCY_IN_PROGRESS - DEPENDENCY_UNAVAILABLE - INTERNAL_ERROR - type: string minLength: 1 message: type: string minLength: 1 requestId: type: string minLength: 8 details: type: object additionalProperties: {} required: - code - message - requestId additionalProperties: false CustomerAuthSecret: type: string pattern: ^[a-f0-9]{64}$ securitySchemes: StorefrontCustomerAuthIntent: type: apiKey in: header name: X-Customer-Auth-Intent description: >- Original 256-bit client admission/replay secret, never a verification proof. StorefrontCustomerChallenge: type: apiKey in: header name: X-Customer-Challenge description: >- Purpose-limited challenge capability, paired with the original intent secret. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.