Complete an SCA login

Finalize an SCA login by submitting the proof for the started factor (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId for SMS_OTP. Returns the reported session status.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 000000.

POST /sca/login/complete

Complete an SCA login

cURL

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/login/complete \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "endUserIpAddress": "203.0.113.42",
  "challengeId": "<string>",
  "code": "000000",
  "passkeyAssertion": {},
  "origin": "https://app.example.com"
}
'

200

{
  "status": "SUCCESS",
  "sessionExpiresAt": "2026-01-29T12:00:00Z"
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Query Parameters

customerId · string · required

The unique identifier of the customer completing an SCA login.

Body

application/json

Completes an SCA login by submitting the proof for the started factor. Carries the same proof fields as an ScaAuthorization (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), plus the factor being completed, the endUserIpAddress the login is being performed from, and, for SMS_OTP, the challengeId returned by the login start. Provide exactly one of code or passkeyAssertion, with origin alongside a passkeyAssertion.

factor · enum<string> · required

The factor being completed; must match the started login.

Available options: SMS_OTP, TOTP, PASSKEY

endUserIpAddress · string · required

The IP address of the end user's device completing this login, recorded against the login event by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment and any transaction-risk exemption.

Example:

"203.0.113.42"

challengeId · string | null

The challenge handle returned by the login start, required for SMS_OTP and omitted for other factors.

code · string | null

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 000000.

Example:

"000000"

passkeyAssertion · object | null

Opaque WebAuthn assertion produced by the device from the login start's passkeyOptions. Required when completing a PASSKEY login.

origin · string | null

The WebAuthn origin the passkeyAssertion was produced against (one of the login start's allowedOrigins). Required alongside passkeyAssertion; omit it for the code path.

Example:

"https://app.example.com"

Response

200

application/json

SCA login completed; the session status is returned.

The status of a completed SCA login session.

status · string · required

The status of the login session. A successful login reports SUCCESS; other values indicate the login did not complete and should be surfaced to the caller.

Example:

"SUCCESS"

sessionExpiresAt · string<date-time> | null

Absolute UTC timestamp after which the customer's SCA session is no longer valid and they must complete another SCA login. Money movement in SCA-regulated currencies is refused once it passes, so prompt a re-login ahead of it rather than waiting for a SCA_SESSION_REQUIRED failure. Present when the login established a session.

Example:

"2026-01-29T12:00:00Z"