Auth

Create an authentication request (server-to-server)

Called by the provider's backend with HTTP Basic (keyId:keySecret). audience must be an exact origin on the provider's allow-list. Physical requests return a short-lived clientToken; NFC requests return a pairing hint.

post/auth/requests

Request

  • Base URL: https://atk.tvarka.pro/v1
  • URL: https://atk.tvarka.pro/v1/auth/requests
  • Auth: HTTP basic

Request body

audiencestring required

The relying-party origin (must be exactly on the provider's allow-list), e.g. https://www.epaslaugos.lt.

method'physical' | 'nfc' required

physical = desktop reader; nfc = phone tap.

messagestring

Optional short message the client may display to the user.

externalIdstring

Provider's own correlation id (echoed back, deduped).

webhookUrlstring uri

Optional public HTTPS webhook for the terminal status; private/non-global destinations are rejected.

Example request

{
  "audience": "https://www.epaslaugos.lt",
  "method": "physical"
}

Response

Request created; awaiting the ATK client authorization.

requestIdstring uuid required
method'physical' | 'nfc' required

physical = desktop reader; nfc = phone tap.

verificationCodestring required

NFC anti-relay confirmation code.

clientTokenstring

Scoped bearer JWT for physical-card /certificate + /complete.

status'pending' | 'awaitingCard' | 'awaitingCredentials' | 'finalizing' | 'done' | 'cancelled' | 'timeout' | 'deviceError' | 'pinBlocked' | 'cardRemoved' | 'certInvalid' required

Flat request status. Non-terminal - pending, awaitingCard, awaitingCredentials, finalizing. Terminal success - done. Terminal failure - cancelled/timeout/deviceError/pinBlocked/cardRemoved/certInvalid. awaitingCredentials is SDK-reported (CAN/PIN entry is out-of-band).

expiresAtstring date-time required
challengeProfile'atk-auth-v1'
noncestring

Server-minted challenge nonce (see Challenge), so the provider backend can re-derive dtbs and verify sig independently - no device relay needed.

Example response

{
  "method": "physical",
  "pairing": {
    "pairingUrl": "https://sign.tvarka.pro/atk-login/#PAIRING_TOKEN",
    "deepLink": "tvarkasign://atk/pair/PAIRING_TOKEN",
    "qrPayload": "https://sign.tvarka.pro/atk-login/#PAIRING_TOKEN"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.