---
title: "Start a developer-key login and receive the payload to sign"
method: POST
path: "/auth/challenge"
tags: ["auth"]
---

# Start a developer-key login and receive the payload to sign

`POST /auth/challenge`

## Request

- The document declares no server URL.
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/hevn-inc/apis/hevn-api/docs/auth/challenge/post.ts> (a function with typed inputs; its response is checked against the schema)

Start developer-key authentication. Sign the returned payload with the registered key and exchange it once through `POST /auth/token` before it expires.

## Request body

- ChallengeRequest
  - `email` string, email, required: Email address of the account that owns the registered developer key.
  - `publicKey` string, required: Base64 DER SubjectPublicKeyInfo for the registered P-256 developer key.
  - `nonce` integer, required: Caller-generated single-use number included in the signed authentication proof.
  - `requestExpiry` integer, required: Unix time in milliseconds after which the signed request is refused.
  - `signature` string, required: Base64 DER ECDSA P-256/SHA-256 signature over the login proof message.

## Response `200`

Successful Response

- ChallengeResponse
  - `challengeId` string, uuid, required: Single-use authentication challenge identifier.
  - `payload` string, required: Base64-encoded canonical authorization payload the developer key must sign.
  - `expiresAt` string, date-time, required: UTC timestamp after which the challenge is refused.

## Other responses

- `422`: Request validation failed

## Changes

- **2026-11-12** `299a3aa6f521`: 1 warning, 2 info
  - added the new `verification_not_applicable` enum value to the `error/code` response property for the response status `422`
  - removed the `phone_required` enum value from the `error/code` response property for the response status `422`
  - removed the `rail_requirements_unmet` enum value from the `error/code` response property for the response status `422`
- **2026-10-23** `a02795de2d2b`: 9 warning, 5 info
  - deleted the `header` request parameter `x-api-key`
  - added the new `client_already_linked` enum value to the `error/code` response property for the response status `422`
  - added the new `kyb_documents_processing` enum value to the `error/code` response property for the response status `422`
  - added the new `link_code_expired` enum value to the `error/code` response property for the response status `422`
  - …10 more
- **2026-10-20** `19eb00e9f258`: 1 info
  - removed the `phone_in_use` enum value from the `error/code` response property for the response status `422`
- **2026-10-20** `bd6c9d69540e`: 1 warning
  - added the new `phone_in_use` enum value to the `error/code` response property for the response status `422`
- **2026-10-20** `19eb00e9f258`: 1 info
  - removed the `document_fields_missing` enum value from the `error/code` response property for the response status `422`

[Operation history](https://skmtc.dev/hevn-inc/apis/hevn-api/changes/auth/challenge/post.md)

---

[API](https://skmtc.dev/hevn-inc/apis/hevn-api.md) - [All operations](https://skmtc.dev/hevn-inc/apis/hevn-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hevn-inc/apis/hevn-api/revisions/299a3aa6f521?raw)