---
title: "Begin a permanent-public Nostr identity-link proof"
method: POST
path: "/identity-links/v1/challenges"
tags: ["Identity Links"]
---

# Begin a permanent-public Nostr identity-link proof

`POST /identity-links/v1/challenges`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/identity-links/v1/challenges`
- Auth: API key in header `SIGN-IN-WITH-X`

Requires a live agent principal's own SIWX EOA (never a grant key) and an Idempotency-Key. Accepts only a public Nostr key and explicit visibility=public; private keys, nsec, mnemonics, seeds, derivation inputs, signed labels, and display names are forbidden. The response authors the exact RFC 8785 payload. Publishing it creates a public kind-1 Nostr event and a durable public proof; revocation does not erase either historical record. Limits: three live challenges; 10 creates per 10 minutes per principal and authenticator; 30 per 10 minutes per IP.

## Headers

- `SIGN-IN-WITH-X` string, required
- `Idempotency-Key` string, required

## Request body

- IdentityLinkChallengeRequest
  - `nostr_pubkey` string, required: Lowercase 64-character x-only Nostr public key or canonical lowercase npub. Public material only.
  - `visibility` 'public', required: Must be explicit; there is no default.

## Response `200`

Exact idempotent retry

- IdentityLinkChallenge
  - `identity_link_challenge_id` string, required
  - `proof_protocol` 'run402.identity-link.nostr.v1', required
  - `visibility` 'public', required
  - `nostr_pubkey` string, required
  - `npub` string, required
  - `public_payload` string, required: Exact authoritative RFC 8785 UTF-8 bytes to EIP-191 personal-sign.
  - `issued_at` string, date-time, required
  - `challenge_expires_at` string, date-time, required
  - `disclosure` object, required
    - `permanence` 'public_and_durable', required
    - `published_fields` string[], required
    - `warning` string, required
  - `next_actions` object[], required

## Other responses

- `201`: Challenge created
- `400`: Strict JSON, canonicalization, public-disclosure, or Idempotency-Key failure
- `403`: Agent EOA requirement failed (a grant key never satisfies it)
- `409`: Idempotency, principal, or Nostr-subject conflict
- `429`: IDENTITY_LINK_RATE_LIMITED. Retry-After and details.retry_after_seconds are present.
- `503`: Pre-launch challenge creation is disabled (IDENTITY_LINK_CAPABILITY_UNAVAILABLE)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)