LIlightsparkdev
Strong Customer Authentication

Complete an SCA login

Changed on

Finalize an SCA login by submitting the proof for the started factor (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId for SMS_OTP. Returns the reported session status.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 000000.

post/sca/login/complete

Request

  • Base URL
    https://api.lightspark.com/grid/2025-10-13
  • URL
    https://api.lightspark.com/grid/2025-10-13/sca/login/complete
  • Auth
    HTTP basic

Request body

factor'SMS_OTP' | 'TOTP' | 'PASSKEY' required

A Strong Customer Authentication factor.

FactorDescription
SMS_OTPOne-time code sent by SMS to the customer's verified phone. Requires no prior enrollment.
TOTPTime-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking).
PASSKEYWebAuthn passkey assertion. Requires enrollment.
endUserIpAddressstring required

The IP address of the end user's device completing this login, recorded against the login event by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment and any transaction-risk exemption.

challengeIdstring nullable

The challenge handle returned by the login start, required for SMS_OTP and omitted for other factors.

codestring nullable

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 000000.

passkeyAssertionobject nullable

Opaque WebAuthn assertion produced by the device from the login start's passkeyOptions. Required when completing a PASSKEY login.

originstring nullable

The WebAuthn origin the passkeyAssertion was produced against (one of the login start's allowedOrigins). Required alongside passkeyAssertion; omit it for the code path.

Example request

{
  "endUserIpAddress": "203.0.113.42",
  "code": "000000",
  "origin": "https://app.example.com"
}

Response

SCA login completed; the session status is returned.

statusstring required

The status of the login session. A successful login reports SUCCESS; other values indicate the login did not complete and should be surfaced to the caller.

sessionExpiresAtstring date-time nullable

Absolute UTC timestamp after which the customer's SCA session is no longer valid and they must complete another SCA login. Money movement in SCA-regulated currencies is refused once it passes, so prompt a re-login ahead of it rather than waiting for a SCA_SESSION_REQUIRED failure. Present when the login established a session.

Example response

{
  "status": "SUCCESS",
  "sessionExpiresAt": "2026-01-29T12:00:00Z"
}

Changes

  • d996ddfb9d2bRevision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f11f1e76bdd7Revision changes
    • warning

      added the new PURCHASE_CARD_LIMIT_REACHED enum value to the response property for the response status