POST/auth/challenge
Request an auth challenge
Operation auth.challenge
Description
Starts sign-in for a registered identity: the server stores a short-lived random challenge for the signing key fingerprint, and the client signs it and sends the signature to POST /auth/verify. No session is needed; an unknown fingerprint returns 404.
Authentication
No session is required.
Request body
application/jsonChallengeRequest
Asks for a sign-in challenge for a registered identity.
1 field
fingerprintstringrequired- exactly 64 characters
- lowercase hexadecimal
Lowercase hex SHA-256 fingerprint of the identity's ML-DSA-87 signing public key.
Other fields are allowed.
Responses
200 OK
application/jsonChallengeResponse
A one-time sign-in challenge that the client signs and returns to POST /auth/verify.
1 field
challengestringrequired- exactly 64 characters
- lowercase hexadecimal
Random hex challenge; it expires after a short time and can be verified once.
Other fields are allowed.
Other responses
| Status | Meaning | Body |
|---|---|---|
| 400 | Bad Request |
|
| 404 | Not Found |
|
| 500 | Internal Server Error |
|
| 503 | Service Unavailable |
|