---
title: "Start SCA factor enrollment"
method: POST
path: "/sca/factors"
tags: ["Strong Customer Authentication"]
---

# Start SCA factor enrollment

`POST /sca/factors`

Begin enrolling an SCA factor for the customer. Enrollment covers the
explicit, opt-in factors a customer chooses to add — the request body's
`type` selects `TOTP` or `PASSKEY`. Returns the factor-specific material
needed to finish via `POST /sca/factors/confirm`.

`SMS_OTP` is implicit and is not enrolled through this endpoint. Every
customer in an SCA-regulated region has a verified phone number from
customer creation (via the Contact Verification flows —
`POST /customers/{customerId}/verify-phone` and `.../verify-phone/confirm`),
so SMS is always available as a factor with no extra setup and appears
among the customer's enrolled factors in `GET /sca/factors`.

A customer may have **only one passkey**. Starting a passkey enrollment when
one is already enrolled returns `409` (`PASSKEY_ALREADY_ENROLLED`) — delete it
via `DELETE /sca/factors/{credentialId}` first.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

## Request body

- union — Which SCA factor to begin enrolling, selected by `type`. `SMS_OTP` is not enrollable (it uses the customer's verified phone), so only `TOTP` and `PASSKEY` are valid here.
  - TotpFactorEnrollRequest — Start enrolling a time-based one-time-password (TOTP) authenticator factor.
    - `type` 'TOTP', required — Discriminator selecting the TOTP factor. TOTP enrollment needs no other input at start.
  - PasskeyFactorEnrollRequest — Start enrolling a WebAuthn passkey factor.
    - `type` 'PASSKEY', required — Discriminator selecting the passkey factor. Passkey enrollment needs no other input at start.

## Response `200`

Enrollment started; the factor-specific completion material is returned.

- union — The factor-specific material needed to complete enrollment, keyed by `type`: a TOTP shared secret + provisioning URI, or the WebAuthn registration options for a passkey.
  - TotpEnrollmentStart — The shared secret a customer's authenticator app needs to enroll a TOTP factor. Returned by `POST /sca/factors` for a `TOTP` request; the customer scans `totpUri` (an `otpauth://` provisioning URI) and confirms with the first code their app produces.
    - `type` 'TOTP', required — Discriminator identifying this as the TOTP enrollment-start payload.
    - `secret` string, required — The raw TOTP shared secret.
    - `secretBase32Encoded` string, required — The Base32-encoded shared secret, suitable for manual entry into an authenticator app that does not scan QR codes.
    - `totpUri` string, required — The `otpauth://` provisioning URI (the QR-code payload) the customer's authenticator app scans to enroll the factor.
  - PasskeyEnrollmentStart — Opaque WebAuthn registration options relayed to the end user's device to enroll a passkey factor. Grid performs no crypto; pass `options` to the device's WebAuthn API to produce a credential, then submit that credential to the confirm endpoint unmodified.
    - `type` 'PASSKEY', required — Discriminator identifying this as the passkey enrollment-start payload.
    - `options` object, required — Opaque WebAuthn `PublicKeyCredentialCreationOptions`. Pass to the device's WebAuthn registration API unmodified.
    - `allowedOrigins` string[], required — The origins the WebAuthn registration ceremony may run against. The origin the credential is produced against must be one of these and must be echoed back on the confirm call.
    - `relyingPartyId` string, required — The WebAuthn relying-party id the credential is bound to.

## Other responses

- `400` — Invalid request
- `401` — Unauthorized
- `404` — Customer not found
- `409` — SCA is not required for this customer (`CONFLICT`), or a passkey enrollment was requested while one is already enrolled (`PASSKEY_ALREADY_ENROLLED`) — only one passkey per customer is supported.
- `500` — Internal service error

## Changes

- **2026-08-14** `aaa1fb8782c8` — 1 warning
  - added the new `EXTERNAL_ACCOUNT_VERIFICATION_REQUIRED` enum value to the `code` response property for the response status `400`
- **2026-08-13** `df12ec487f0e` — 1 warning
  - added the new `TRANSACTION_SIZE_LIMIT_EXCEEDED` enum value to the `code` response property for the response status `400`
- **2026-08-11** `b06902b6595a` — 4 warning
  - added the new `CARDHOLDER_KYC_NOT_APPROVED` enum value to the `code` response property for the response status `400`
  - added the new `CARD_ALREADY_CLOSED` enum value to the `code` response property for the response status `409`
  - added the new `CARD_NOT_MUTABLE` enum value to the `code` response property for the response status `409`
  - added the new `INVALID_STATE_TRANSITION` enum value to the `code` response property for the response status `409`
- **2026-08-06** `526036c12609` — 1 warning
  - added the new `END_USER_TERMS_VERSION_NOT_FOUND` enum value to the `code` response property for the response status `400`
- **2026-07-31** `b21ed434ee6e` — 2 warning, 1 info
  - added the new `BENEFICIARY_TRUSTED` enum value to the `code` response property for the response status `409`
  - added the new `SCA_SESSION_REQUIRED` enum value to the `code` response property for the response status `409`
  - added the optional property `details/errors` to the response with the `400` status

[Full history](https://skmtc.dev/stainless-api/apis/grid-api/changes/sca/factors/post.md)

---

[API](https://skmtc.dev/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.dev/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/2ec84c06fbec/schema)