Skip to content
Authrim

Start TOTP login or reauthentication.

POST
/api/auth/totp/login/start
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/auth/totp/login/start \
  --header 'Content-Type: application/json' \
  --data '{ "identifier": "user@example.com" }'

Creates a short-lived TOTP challenge for either an email or username identifier, or an opaque OIDC reauthentication challenge. Exactly one input must be supplied. The reauthentication form resolves the bound subject server-side and does not disclose the subject identifier to the browser.

Request Body required

Section titled “Request Body required ”
Media type application/json
One of:
object
identifier
required

Email address or username/user identifier.

string
>= 1 characters
authorization_challenge_id

Opaque reauthentication challenge whose bound subject is resolved server-side.

string
>= 1 characters <= 128 characters
key
additional properties
Example 
{
  "identifier": "user@example.com"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

TOTP login challenge response.

Media type application/json
object
challenge_id
required
string
expires_in
required
integer
>= 1
Example generated
{
  "challenge_id": "example",
  "expires_in": 1
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}