---
title: "Start a device-bound passkey import (native apps)"
method: POST
path: "/user/passkey/import/start"
tags: ["Enrollment"]
---

# Start a device-bound passkey import (native apps)

`POST /user/passkey/import/start`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/user/passkey/import/start`
- Auth: API key in header `api-key` and API key in header `Authorization`

Issues the challenge for importing a hardware-bound key (Secure Enclave / Android Keystore) as a passkey. The app must bind this exact `challenge` into its attestation — Android `setAttestationChallenge(challenge bytes)` at key generation; iOS App Attest with `clientDataHash = SHA-256(proof.clientData bytes)`, where the proof document embeds the challenge, the subject, the credential id and the public key hash — and into the proof it signs for `/passkey/import/complete`. Requires `'passkey'` in the application's `allowedScaMethods` and a `deviceAttestation` configuration for the platform (else `100010`). The two-passkey cap applies (`100004`). The challenge lives 10 minutes and is single use. — Requires an active SCA session granted within the last 15 minutes, else `30070` (`SCA_REQUIRED`) with `reason` `NO_SESSION` or `EXPIRED`, exactly as the SCA-gated reads report it; run `/user/login/start` + `/user/login/complete` and retry inside the window. An open 2FA reset for this factor whose `/complete` call has already removed the old factor authorizes the call as well, and users without an SCA-gated (EUR/USDC) account yet are exempt.

## Request body

- object
  - `userId` string, required
  - `platform` 'IOS' | 'ANDROID', required

## Response `200`

The import challenge.

- object
  - `challengeId` string, uuid, required
  - `challenge` string, required: 32 random bytes, base64url without padding.
  - `expiresAt` string, date-time, required
  - `relyingPartyId` string, required

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)