---
title: "Start an SCA login"
method: POST
path: "/sca/login/start"
tags: ["Strong Customer Authentication"]
---

# Start an SCA login

`POST /sca/login/start`

Begin an SCA login for the customer with the chosen factor, opening the
end-user SCA session (an exemption gating read / account access beyond the
per-transaction window). Returns factor-specific material: `SMS_OTP`
dispatches a code and returns a `challengeId` + `expiresAt`; `TOTP` returns
only the factor (the customer reads the code from their app); `PASSKEY`
returns WebAuthn `passkeyOptions`. Complete with
`POST /sca/login/complete`.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

## Request body

- ScaLoginStartRequest — Selects which enrolled factor to start an SCA login with. The factor must already be enrolled (or, for `SMS_OTP`, the phone verified).
  - `factor` 'SMS_OTP' | 'TOTP' | 'PASSKEY', required — A Strong Customer Authentication factor. | Factor | Description | |--------|-------------| | `SMS_OTP` | One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment. | | `TOTP` | Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking). | | `PASSKEY` | WebAuthn passkey assertion. Requires enrollment. |

## Response `200`

SCA login started; factor-specific material is returned.

- ScaLoginStart — The factor-specific material a customer needs to complete an SCA login. Each factor surfaces only the fields it issues: `SMS_OTP` carries `challengeId` and `expiresAt`; `TOTP` carries neither (the customer reads the code from their authenticator app); `PASSKEY` carries the opaque WebAuthn `passkeyOptions` with `allowedOrigins` and `relyingPartyId`.
  - `factor` 'SMS_OTP' | 'TOTP' | 'PASSKEY', required — A Strong Customer Authentication factor. | Factor | Description | |--------|-------------| | `SMS_OTP` | One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment. | | `TOTP` | Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking). | | `PASSKEY` | WebAuthn passkey assertion. Requires enrollment. |
  - `challengeId` string, nullable — The challenge handle for an `SMS_OTP` login, threaded back on the complete call. Present only for `SMS_OTP`.
  - `expiresAt` string, date-time, nullable — Absolute UTC timestamp after which the `SMS_OTP` code expires. Present only for `SMS_OTP`.
  - `passkeyOptions` object, nullable — Opaque WebAuthn assertion request options. Present only for `PASSKEY`; pass to the device's WebAuthn API to produce the assertion submitted on the complete call.
  - `allowedOrigins` string[], nullable — The origins the WebAuthn ceremony may run against. Present only for `PASSKEY`.
  - `relyingPartyId` string, nullable — The WebAuthn relying-party id. Present only for `PASSKEY`.

## Other responses

- `400` — Invalid or unknown factor
- `401` — Unauthorized
- `404` — Customer not found
- `409` — SCA is not required for this customer.
- `500` — Internal service error

## Changes

- **2026-08-14** `aaa1fb8782c8` — 1 warning
  - added the new `EXTERNAL_ACCOUNT_VERIFICATION_REQUIRED` enum value to the `code` response property for the response status `400`
- **2026-08-13** `df12ec487f0e` — 1 warning
  - added the new `TRANSACTION_SIZE_LIMIT_EXCEEDED` enum value to the `code` response property for the response status `400`
- **2026-08-11** `b06902b6595a` — 4 warning
  - added the new `CARDHOLDER_KYC_NOT_APPROVED` enum value to the `code` response property for the response status `400`
  - added the new `CARD_ALREADY_CLOSED` enum value to the `code` response property for the response status `409`
  - added the new `CARD_NOT_MUTABLE` enum value to the `code` response property for the response status `409`
  - added the new `INVALID_STATE_TRANSITION` enum value to the `code` response property for the response status `409`
- **2026-08-06** `526036c12609` — 1 warning
  - added the new `END_USER_TERMS_VERSION_NOT_FOUND` enum value to the `code` response property for the response status `400`
- **2026-07-31** `b21ed434ee6e` — 2 warning, 1 info
  - added the new `BENEFICIARY_TRUSTED` enum value to the `code` response property for the response status `409`
  - added the new `SCA_SESSION_REQUIRED` enum value to the `code` response property for the response status `409`
  - added the optional property `details/errors` to the response with the `400` status

[Full history](https://skmtc.dev/stainless-api/apis/grid-api/changes/sca/login/start/post.md)

---

[API](https://skmtc.dev/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.dev/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/2ec84c06fbec/schema)