---
title: "Auth Challenge"
method: GET
path: "/api/auth/challenge"
tags: ["auth", "billing"]
---

# Auth Challenge

`GET /api/auth/challenge`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/auth/challenge`
- Auth: none declared

Issue a proof-of-work challenge for registration.

Returns a 32-char hex challenge valid for 5 minutes.
Client must find a nonce such that SHA256(challenge + nonce) starts with '000'.

Also issues an anonymous CSRF token (stored in `ol_csrf` cookie + returned
in body) so the subsequent /api/auth/register POST can be protected by the
same `validate_csrf` dependency used everywhere else. Prior to this, register
relied on PoW + rate limit only, leaving it inconsistent with the rest of
the state-changing endpoints.

## Response `200`

Successful Response

- AuthActionResponse: Loose response_model for auth routes (signin/register/oauth callbacks). Multi-shape success vs error envelopes; FE branches on specific keys via the public typed wrappers.

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)