---
title: "Verify a step-up challenge with an OTP code, TOTP code, or a passkey token"
method: POST
path: "/v1/challenges/verify"
tags: ["Challenges"]
---

# Verify a step-up challenge with an OTP code, TOTP code, or a passkey token

`POST /v1/challenges/verify`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/challenges/verify`
- Auth: HTTP bearer

Verifies a step-up action for the caller. Supply `code` for the email/SMS OTP path; add `factor: "totp"` to verify a code from an enrolled authenticator app instead; or supply `token` (an Ideem authenticate() token) to satisfy the same gate with an enrolled passkey. Passkey and TOTP are accepted only for the wallet/step-up actions. `code` and `token` are mutually exclusive.

## Request body

- MfaVerifyChallengeRequestEnvelopeDTO
  - `data` object
    - `attributes` MfaVerifyChallengeRequestDTO
      - `action` string, required
      - `client` string
      - `code` string
      - `factor` 'email' | 'sms' | 'totp'
      - `token` object

## Response `204`

No Content

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `410`: Gone
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error
- `502`: Bad Gateway

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)