---
title: "Initiate marking a USDC address as Trusted Beneficiary"
method: POST
path: "/wallets/beneficiary/address/trust"
tags: ["Trusted Beneficiary"]
---

# Initiate marking a USDC address as Trusted Beneficiary

`POST /wallets/beneficiary/address/trust`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/wallets/beneficiary/address/trust`
- Auth: API key in header `api-key` and API key in header `Authorization`

Only `USDC`, `USDC_POLYGON`, and `USDC_SOL` addresses are eligible; other currencies are rejected with `30075` (`CURRENCY_NOT_TRUSTABLE`).

## Request body

- object
  - `userId` string, required
  - `whitelistedAddressId` string, required
  - `verificationMethod` 'sms' | 'totp' | 'passkey': Defaults to `sms` when omitted.

## Response `200`

Challenge issued. Factor-specific fields populated based on `verificationMethod` (`challengeId`+`dateExpires` for sms, `options`+`allowedOrigins`+`relyingPartyId` for passkey, `ok` for totp).

- object
  - `verificationMethod` 'sms' | 'totp' | 'passkey', required
  - `ok` boolean
  - `challengeId` string
  - `dateExpires` string
  - `options` object: Standard WebAuthn `PublicKeyCredentialRequestOptions`. Base64url-encoded binary fields are passed through to the browser without modification.
    - `challenge` string
    - `timeout` integer
    - `rpId` string
    - `allowCredentials` object[]
      - `type` string
      - `id` string
    - `userVerification` string
  - `allowedOrigins` string[]
  - `relyingPartyId` string

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)