Create an authentication challenge
Issue an authentication challenge. Phone challenges may be issued for registered or unregistered phone numbers. Email challenges are delivered only to the email address already registered to an account. Unknown email addresses, locked accounts, and throttled registered accounts receive the same public response without revealing delivery or account state. A successful email OTP verifies the registered email address. Requests may also be limited by the shared user resend policy or the caller IP. A 429 response includes Retry-After when exposing the wait does not reveal account state.
Body
The request body for issuing a new authentication challenge.
For OTP authentication, either phoneNumber or emailAddress is required. For passkey authentication, phoneNumber or emailAddress is optional (enables usernameless flow when omitted).
The authentication method to use. Defaults to "otp" for backward compatibility.
otp, passkey Phone number used for OTP delivery or username-first passkey authentication. Required for OTP unless emailAddress is provided; optional for passkey.
6 - 32^\+?[0-9]{1,3}?[ .-]?\(?[0-9]{1,4}?\)?[ .-]?[0-9]{1,4}?[ .-]?[0-9]{1,4}?[ .-]?[0-9]{1,9}$Email address used for OTP delivery or username-first passkey authentication. Required for OTP unless phoneNumber is provided; optional for passkey.
6 - 100Response
Created.
- Option 1
- Option 2
Response from creating an authentication challenge.
The response type depends on the authentication method specified in the request:
- For OTP method: Returns a Challenge with ID and expiration
- For passkey method: Returns PasskeyAuthenticationOptions with WebAuthn challenge.
The unique, opaque system identifier for a resource. This case-sensitive ID is also used as path parameters in URLs or in other properties or parameters that reference a resource by ID rather than URL.
The expiration datetime of the challenge in the ISO-8601 format.