Skip to main content
POST
Prepare a merchant-bound customer code challenge

Authorizations

X-Customer-Auth-Intent
string
header
required

Original 256-bit client admission/replay secret, never a verification proof.

Headers

Idempotency-Key
string
required

Caller-stable key reused only for retries of this exact request.

Required string length: 16 - 128
Pattern: ^[A-Za-z0-9._:-]{16,128}$

Path Parameters

merchantSlug
string
required
Required string length: 1 - 128

Body

application/json
channel
enum<string>
required
Available options:
email
email
string<email>
required
Maximum string length: 254
Pattern: ^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$

Response

Challenge grant. Replays require the original auth intent secret and exact key/body.

challengeId
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$
challengeAccessToken
string
required
Pattern: ^[a-f0-9]{64}$
expiresAt
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
resendAfter
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$