Confirm SCA factor enrollment

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/factors/confirm \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "type": "TOTP",
  "secret": "<string>",
  "code": "123456"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({type: 'TOTP', secret: '<string>', code: '123456'})
};

fetch('https://api.lightspark.com/grid/2025-10-13/sca/factors/confirm', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"type\": \"TOTP\",\n  \"secret\": \"<string>\",\n  \"code\": \"123456\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/sca/factors/confirm")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "type": "TOTP",
  "recoveryCodes": [
    "ABCD-EFGH-IJKL",
    "MNOP-QRST-UVWX"
  ]
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Strong Customer Authentication

Confirm SCA factor enrollment

Finalize the factor enrollment started by POST /sca/factors. The request body is discriminated by type: for TOTP, submit the shared secret from the start call plus the first code; for PASSKEY, submit the WebAuthn credential the device produced plus the origin it was produced against. The threaded secret/credential binds the confirmation to its enrollment, so no separate id is needed.

A TOTP confirmation returns one-time recovery codes (shown once); a passkey confirmation returns the enrolled factor.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the TOTP code is always 123456.

POST

sca

factors

confirm

Confirm SCA factor enrollment

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/sca/factors/confirm \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "type": "TOTP",
  "secret": "<string>",
  "code": "123456"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({type: 'TOTP', secret: '<string>', code: '123456'})
};

fetch('https://api.lightspark.com/grid/2025-10-13/sca/factors/confirm', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"type\": \"TOTP\",\n  \"secret\": \"<string>\",\n  \"code\": \"123456\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/sca/factors/confirm")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "type": "TOTP",
  "recoveryCodes": [
    "ABCD-EFGH-IJKL",
    "MNOP-QRST-UVWX"
  ]
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Authorizations

Authorization

string

header

required

API token authentication using format <api token id>:<api client secret>

Query Parameters

customerId

string

required

The unique identifier of the customer confirming a factor enrollment.

Body

application/json

Option 1
Option 2

The proof that finalizes enrollment, keyed by type: the TOTP shared secret + code, or the passkey origin + credential.

type

enum<string>

required

Discriminator selecting the TOTP confirm variant.

Available options:

TOTP

secret

string

required

The shared secret returned as secret by the TOTP enrollment start, threaded back to bind the confirmation to that enrollment.

code

string

required

The current time-based one-time code from the customer's authenticator app. In sandbox, the code is always 123456.

Example:

"123456"

Response

Factor enrolled; the factor-specific result is returned.

Option 1
Option 2

The enrollment result, keyed by type.

type

enum<string>

required

Discriminator identifying this as the TOTP enrollment result.

Available options:

TOTP

recoveryCodes

string[]

required

The one-time recovery codes for this TOTP factor.

Example:

["ABCD-EFGH-IJKL", "MNOP-QRST-UVWX"]

Start SCA factor enrollment

Delete an enrolled SCA factor

⌘I

Using the API

API documentation

Confirm SCA factor enrollment

Authorizations

Query Parameters

Body

Response