---
title: "Verify QR Code Challenge"
method: POST
path: "/verify/qr-code"
tags: ["QR Code"]
---

# Verify QR Code Challenge

`POST /verify/qr-code`

Verify a QR code challenge. Use this endpoint from the app which initiated the challenge to determine if the user approved or rejected the request (e.g. via polling).

## Request body

- object
  - `challengeId` string, required — The challenge ID returned when starting the QR code challenge.
  - `deviceCode` string, required — The device code returned when starting the QR code challenge.

## Response `200`

OK

- object
  - `isClaimed` boolean, required — True if a user has claimed the challenge on their mobile device. False if no user has claimed the challenge.
  - `isConsumed` boolean, required — True if the user has either approved or rejected the auth request. False if they have not yet responded to the request.
  - `isVerified` boolean, required — True if the user approved the auth request on their mobile device. False if they rejected the request.
  - `accessToken` string — A new short-term token with scopes to manage authenticators (e.g. add secondary authenticators, remove authenticators, view or regenerate recovery codes). Only present if the challenge succeeded.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)