Start a developer-key login and receive the payload to sign
curl --request POST \
--url https://api.example.com/auth/challenge \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
'import requests
url = "https://api.example.com/auth/challenge"
payload = {
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
email: 'jsmith@example.com',
publicKey: '<string>',
nonce: 123,
requestExpiry: 123,
signature: '<string>'
})
};
fetch('https://api.example.com/auth/challenge', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payload": "<string>",
"expiresAt": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}Authentication
Start a developer-key login and receive the payload to sign
Start developer-key authentication. Sign the returned payload with the registered key and exchange it once through POST /auth/token before it expires.
POST
/
auth
/
challenge
Start a developer-key login and receive the payload to sign
curl --request POST \
--url https://api.example.com/auth/challenge \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
'import requests
url = "https://api.example.com/auth/challenge"
payload = {
"email": "jsmith@example.com",
"publicKey": "<string>",
"nonce": 123,
"requestExpiry": 123,
"signature": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
email: 'jsmith@example.com',
publicKey: '<string>',
nonce: 123,
requestExpiry: 123,
signature: '<string>'
})
};
fetch('https://api.example.com/auth/challenge', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"challengeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"payload": "<string>",
"expiresAt": "2023-11-07T05:31:56Z"
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"details": {}
}
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Email address of the account that owns the registered developer key.
Base64 DER SubjectPublicKeyInfo for the registered P-256 developer key.
Caller-generated single-use number included in the signed authentication proof.
Unix time in milliseconds after which the signed request is refused.
Base64 DER ECDSA P-256/SHA-256 signature over the login proof message.
Was this page helpful?