Exchange a signed login challenge for a session - HEVN

Exchange a signed login challenge for a session

curl --request POST \
  --url https://api.example.com/auth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "signature": "<string>",
  "publicKey": "<string>"
}
'

import requests

url = "https://api.example.com/auth/token"

payload = {
    "challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "signature": "<string>",
    "publicKey": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    challengeId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    signature: '<string>',
    publicKey: '<string>'
  })
};

fetch('https://api.example.com/auth/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "accessToken": "<string>",
  "refreshToken": "<string>",
  "expiresIn": 123,
  "userId": "cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"
}

{
  "error": {
    "code": "invalid_request",
    "message": "<string>",
    "details": {}
  }
}

POST

/

auth

/

token

Exchange a signed login challenge for a session

curl --request POST \
  --url https://api.example.com/auth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "signature": "<string>",
  "publicKey": "<string>"
}
'

import requests

url = "https://api.example.com/auth/token"

payload = {
    "challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "signature": "<string>",
    "publicKey": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    challengeId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    signature: '<string>',
    publicKey: '<string>'
  })
};

fetch('https://api.example.com/auth/token', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "accessToken": "<string>",
  "refreshToken": "<string>",
  "expiresIn": 123,
  "userId": "cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"
}

{
  "error": {
    "code": "invalid_request",
    "message": "<string>",
    "details": {}
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

device-id

string | null

x-api-key

string | null

user-agent

string | null

Body

application/json

ChallengeTokenRequest
ProofTokenRequest

challengeId

string<uuid>

required

Single-use challenge identifier returned by POST /dapi/v1/auth/challenge.

signature

string

required

Signature over the decoded payload returned for this challenge.

publicKey

string | null

Registered P-256 public key; omit when the signature uniquely identifies the key.

Response

Successful Response

accessToken

string

required

Short-lived bearer token used to authorize API requests.

refreshToken

string

required

Long-lived device-bound token used only at POST /dapi/v1/auth/refresh.

expiresIn

integer

required

Number of seconds until the access token expires.

userId

string

required

Account selected for the issued session.

Pattern: ^(?:cl_)?[A-Za-z0-9._:\-]{1,216}$

Example:

"cl_9f2c1ab84d7e4f1fa3c65b0e7d9a2c41"