Auth Challenge
Issue a proof-of-work challenge for registration.
Returns a 32-char hex challenge valid for 5 minutes. Client must find a nonce such that SHA256(challenge + nonce) starts with '000'.
Also issues an anonymous CSRF token (stored in ol_csrf cookie + returned in body) so the subsequent /api/auth/register POST can be protected by the same validate_csrf dependency used everywhere else. Prior to this, register relied on PoW + rate limit only, leaving it inconsistent with the rest of the state-changing endpoints.
Request
- Base URL: https://www.oxfordledge.com (the document declares no server; this is the origin it was published from)
- URL: https://www.oxfordledge.com/api/auth/challenge
- Auth: none declared
Response
Successful Response
Loose response_model for auth routes (signin/register/oauth callbacks). Multi-shape success vs error envelopes; FE branches on specific keys via the public typed wrappers.
Changes
No recorded changes to this operation across all 1 revision of this API.