---
title: "Start unified SCA login (business)"
method: POST
path: "/business/login/start"
tags: ["Business Login"]
---

# Start unified SCA login (business)

`POST /business/login/start`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/login/start`
- Auth: API key in header `api-key` and API key in header `Authorization`

Issues a server-side challenge for the chosen factor. With `sms` the response carries `challengeId` + `dateExpires` and an OTP is dispatched. With `passkey` the response carries the WebAuthn assertion request (`options`, `allowedOrigins`, `relyingPartyId`) for the browser. With `totp` the response is `{ ok: true }` — the operator reads the code from their authenticator app.

## Request body

- object
  - `businessId` string, uuid, required
  - `verificationMethod` 'sms' | 'totp' | 'passkey', required

## Response `200`

Factor-specific challenge. The populated fields depend on `verificationMethod`: `sms` returns `challengeId` + `dateExpires`; `passkey` returns `options` + `allowedOrigins` + `relyingPartyId`; `totp` returns `ok`.

- object
  - `ok` boolean: Present for `totp`.
  - `challengeId` string: Present for `sms`.
  - `dateExpires` string: Present for `sms`.
  - `options` object: Standard WebAuthn `PublicKeyCredentialRequestOptions`. Base64url-encoded binary fields are passed through to the browser without modification.
    - `challenge` string
    - `timeout` integer
    - `rpId` string
    - `allowCredentials` object[]
      - `type` string
      - `id` string
    - `userVerification` string
  - `allowedOrigins` string[]: Present for `passkey`.
  - `relyingPartyId` string: Present for `passkey`.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)