Create an SCA challenge
curl --request POST \
--url https://api-sandbox.circle.com/v1/accounts/passkeys/challenges \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"clientEntityId": "entity_01234567890abcdef",
"operation": "TRANSFER",
"intent": {
"idempotencyKey": "550e8400-e29b-41d4-a716-446655440000",
"source": {
"type": "account",
"id": "1017381855"
},
"destination": {
"type": "verified_blockchain",
"addressId": "c7d8e9f0-a1b2-3456-7890-abcdef123456"
},
"amount": {
"amount": "50.00",
"currency": "USD"
},
"riskSignals": {
"ipAddress": "203.0.113.42",
"sessionId": "sess_abcdefghij",
"deviceId": "dev_klmnopqrst"
}
},
"ceremonyKind": "webauthn",
"pathParameters": {
"id": "a1b2c3d4-e5f6-7890-ab12-cdef34567890"
},
"embedOrigin": "https://app.example.com"
}
'import requests
url = "https://api-sandbox.circle.com/v1/accounts/passkeys/challenges"
payload = {
"clientEntityId": "entity_01234567890abcdef",
"operation": "TRANSFER",
"intent": {
"idempotencyKey": "550e8400-e29b-41d4-a716-446655440000",
"source": {
"type": "account",
"id": "1017381855"
},
"destination": {
"type": "verified_blockchain",
"addressId": "c7d8e9f0-a1b2-3456-7890-abcdef123456"
},
"amount": {
"amount": "50.00",
"currency": "USD"
},
"riskSignals": {
"ipAddress": "203.0.113.42",
"sessionId": "sess_abcdefghij",
"deviceId": "dev_klmnopqrst"
}
},
"ceremonyKind": "webauthn",
"pathParameters": { "id": "a1b2c3d4-e5f6-7890-ab12-cdef34567890" },
"embedOrigin": "https://app.example.com"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
clientEntityId: 'entity_01234567890abcdef',
operation: 'TRANSFER',
intent: {
idempotencyKey: '550e8400-e29b-41d4-a716-446655440000',
source: {type: 'account', id: '1017381855'},
destination: {type: 'verified_blockchain', addressId: 'c7d8e9f0-a1b2-3456-7890-abcdef123456'},
amount: {amount: '50.00', currency: 'USD'},
riskSignals: {
ipAddress: '203.0.113.42',
sessionId: 'sess_abcdefghij',
deviceId: 'dev_klmnopqrst'
}
},
ceremonyKind: 'webauthn',
pathParameters: {id: 'a1b2c3d4-e5f6-7890-ab12-cdef34567890'},
embedOrigin: 'https://app.example.com'
})
};
fetch('https://api-sandbox.circle.com/v1/accounts/passkeys/challenges', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.circle.com/v1/accounts/passkeys/challenges",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'clientEntityId' => 'entity_01234567890abcdef',
'operation' => 'TRANSFER',
'intent' => [
'idempotencyKey' => '550e8400-e29b-41d4-a716-446655440000',
'source' => [
'type' => 'account',
'id' => '1017381855'
],
'destination' => [
'type' => 'verified_blockchain',
'addressId' => 'c7d8e9f0-a1b2-3456-7890-abcdef123456'
],
'amount' => [
'amount' => '50.00',
'currency' => 'USD'
],
'riskSignals' => [
'ipAddress' => '203.0.113.42',
'sessionId' => 'sess_abcdefghij',
'deviceId' => 'dev_klmnopqrst'
]
],
'ceremonyKind' => 'webauthn',
'pathParameters' => [
'id' => 'a1b2c3d4-e5f6-7890-ab12-cdef34567890'
],
'embedOrigin' => 'https://app.example.com'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.circle.com/v1/accounts/passkeys/challenges"
payload := strings.NewReader("{\n \"clientEntityId\": \"entity_01234567890abcdef\",\n \"operation\": \"TRANSFER\",\n \"intent\": {\n \"idempotencyKey\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"source\": {\n \"type\": \"account\",\n \"id\": \"1017381855\"\n },\n \"destination\": {\n \"type\": \"verified_blockchain\",\n \"addressId\": \"c7d8e9f0-a1b2-3456-7890-abcdef123456\"\n },\n \"amount\": {\n \"amount\": \"50.00\",\n \"currency\": \"USD\"\n },\n \"riskSignals\": {\n \"ipAddress\": \"203.0.113.42\",\n \"sessionId\": \"sess_abcdefghij\",\n \"deviceId\": \"dev_klmnopqrst\"\n }\n },\n \"ceremonyKind\": \"webauthn\",\n \"pathParameters\": {\n \"id\": \"a1b2c3d4-e5f6-7890-ab12-cdef34567890\"\n },\n \"embedOrigin\": \"https://app.example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.circle.com/v1/accounts/passkeys/challenges")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"clientEntityId\": \"entity_01234567890abcdef\",\n \"operation\": \"TRANSFER\",\n \"intent\": {\n \"idempotencyKey\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"source\": {\n \"type\": \"account\",\n \"id\": \"1017381855\"\n },\n \"destination\": {\n \"type\": \"verified_blockchain\",\n \"addressId\": \"c7d8e9f0-a1b2-3456-7890-abcdef123456\"\n },\n \"amount\": {\n \"amount\": \"50.00\",\n \"currency\": \"USD\"\n },\n \"riskSignals\": {\n \"ipAddress\": \"203.0.113.42\",\n \"sessionId\": \"sess_abcdefghij\",\n \"deviceId\": \"dev_klmnopqrst\"\n }\n },\n \"ceremonyKind\": \"webauthn\",\n \"pathParameters\": {\n \"id\": \"a1b2c3d4-e5f6-7890-ab12-cdef34567890\"\n },\n \"embedOrigin\": \"https://app.example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.circle.com/v1/accounts/passkeys/challenges")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"clientEntityId\": \"entity_01234567890abcdef\",\n \"operation\": \"TRANSFER\",\n \"intent\": {\n \"idempotencyKey\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"source\": {\n \"type\": \"account\",\n \"id\": \"1017381855\"\n },\n \"destination\": {\n \"type\": \"verified_blockchain\",\n \"addressId\": \"c7d8e9f0-a1b2-3456-7890-abcdef123456\"\n },\n \"amount\": {\n \"amount\": \"50.00\",\n \"currency\": \"USD\"\n },\n \"riskSignals\": {\n \"ipAddress\": \"203.0.113.42\",\n \"sessionId\": \"sess_abcdefghij\",\n \"deviceId\": \"dev_klmnopqrst\"\n }\n },\n \"ceremonyKind\": \"webauthn\",\n \"pathParameters\": {\n \"id\": \"a1b2c3d4-e5f6-7890-ab12-cdef34567890\"\n },\n \"embedOrigin\": \"https://app.example.com\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"challengeId": "b2c3d4e5-f6a7-8901-bc23-def456789012",
"frameToken": "k74ia-AcnTzXtBdxnbVqn1IBpVUXBbhGiGxQkGD386A",
"expiresAt": "2026-09-24T12:05:00Z",
"summary": {
"type": "transfer",
"amount": {
"amount": "50.00",
"currency": "USD"
},
"destination": "1001587127",
"sourceAccountLabel": "My DAA account"
}
}
}{
"code": 2,
"message": "API parameter invalid."
}{
"code": 4,
"message": "Unauthorized."
}{
"code": 2,
"message": "API parameter invalid.",
"externalMessage": "The provided amount exceeds the maximum allowed.",
"errors": [
{
"error": "invalid_value",
"message": "The operation and assetType combination is invalid.",
"location": "assetType"
}
]
}{
"code": -1,
"message": "Something went wrong. errId: 1f0b0c455e40f753f07b4f0ae6abd4b4"
}Create an SCA challenge
Creates a short-lived, single-use challenge (5-minute TTL) that captures the intent of a protected operation. Pass the returned frameToken to the DAA web SDK’s sca.approve method to produce a signed assertion. The intent must exactly match the request body you will send to the protected endpoint — same fields, same values.
POST
/
v1
/
accounts
/
passkeys
/
challenges
Create an SCA challenge
curl --request POST \
--url https://api-sandbox.circle.com/v1/accounts/passkeys/challenges \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"clientEntityId": "entity_01234567890abcdef",
"operation": "TRANSFER",
"intent": {
"idempotencyKey": "550e8400-e29b-41d4-a716-446655440000",
"source": {
"type": "account",
"id": "1017381855"
},
"destination": {
"type": "verified_blockchain",
"addressId": "c7d8e9f0-a1b2-3456-7890-abcdef123456"
},
"amount": {
"amount": "50.00",
"currency": "USD"
},
"riskSignals": {
"ipAddress": "203.0.113.42",
"sessionId": "sess_abcdefghij",
"deviceId": "dev_klmnopqrst"
}
},
"ceremonyKind": "webauthn",
"pathParameters": {
"id": "a1b2c3d4-e5f6-7890-ab12-cdef34567890"
},
"embedOrigin": "https://app.example.com"
}
'import requests
url = "https://api-sandbox.circle.com/v1/accounts/passkeys/challenges"
payload = {
"clientEntityId": "entity_01234567890abcdef",
"operation": "TRANSFER",
"intent": {
"idempotencyKey": "550e8400-e29b-41d4-a716-446655440000",
"source": {
"type": "account",
"id": "1017381855"
},
"destination": {
"type": "verified_blockchain",
"addressId": "c7d8e9f0-a1b2-3456-7890-abcdef123456"
},
"amount": {
"amount": "50.00",
"currency": "USD"
},
"riskSignals": {
"ipAddress": "203.0.113.42",
"sessionId": "sess_abcdefghij",
"deviceId": "dev_klmnopqrst"
}
},
"ceremonyKind": "webauthn",
"pathParameters": { "id": "a1b2c3d4-e5f6-7890-ab12-cdef34567890" },
"embedOrigin": "https://app.example.com"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
clientEntityId: 'entity_01234567890abcdef',
operation: 'TRANSFER',
intent: {
idempotencyKey: '550e8400-e29b-41d4-a716-446655440000',
source: {type: 'account', id: '1017381855'},
destination: {type: 'verified_blockchain', addressId: 'c7d8e9f0-a1b2-3456-7890-abcdef123456'},
amount: {amount: '50.00', currency: 'USD'},
riskSignals: {
ipAddress: '203.0.113.42',
sessionId: 'sess_abcdefghij',
deviceId: 'dev_klmnopqrst'
}
},
ceremonyKind: 'webauthn',
pathParameters: {id: 'a1b2c3d4-e5f6-7890-ab12-cdef34567890'},
embedOrigin: 'https://app.example.com'
})
};
fetch('https://api-sandbox.circle.com/v1/accounts/passkeys/challenges', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.circle.com/v1/accounts/passkeys/challenges",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'clientEntityId' => 'entity_01234567890abcdef',
'operation' => 'TRANSFER',
'intent' => [
'idempotencyKey' => '550e8400-e29b-41d4-a716-446655440000',
'source' => [
'type' => 'account',
'id' => '1017381855'
],
'destination' => [
'type' => 'verified_blockchain',
'addressId' => 'c7d8e9f0-a1b2-3456-7890-abcdef123456'
],
'amount' => [
'amount' => '50.00',
'currency' => 'USD'
],
'riskSignals' => [
'ipAddress' => '203.0.113.42',
'sessionId' => 'sess_abcdefghij',
'deviceId' => 'dev_klmnopqrst'
]
],
'ceremonyKind' => 'webauthn',
'pathParameters' => [
'id' => 'a1b2c3d4-e5f6-7890-ab12-cdef34567890'
],
'embedOrigin' => 'https://app.example.com'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.circle.com/v1/accounts/passkeys/challenges"
payload := strings.NewReader("{\n \"clientEntityId\": \"entity_01234567890abcdef\",\n \"operation\": \"TRANSFER\",\n \"intent\": {\n \"idempotencyKey\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"source\": {\n \"type\": \"account\",\n \"id\": \"1017381855\"\n },\n \"destination\": {\n \"type\": \"verified_blockchain\",\n \"addressId\": \"c7d8e9f0-a1b2-3456-7890-abcdef123456\"\n },\n \"amount\": {\n \"amount\": \"50.00\",\n \"currency\": \"USD\"\n },\n \"riskSignals\": {\n \"ipAddress\": \"203.0.113.42\",\n \"sessionId\": \"sess_abcdefghij\",\n \"deviceId\": \"dev_klmnopqrst\"\n }\n },\n \"ceremonyKind\": \"webauthn\",\n \"pathParameters\": {\n \"id\": \"a1b2c3d4-e5f6-7890-ab12-cdef34567890\"\n },\n \"embedOrigin\": \"https://app.example.com\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.circle.com/v1/accounts/passkeys/challenges")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"clientEntityId\": \"entity_01234567890abcdef\",\n \"operation\": \"TRANSFER\",\n \"intent\": {\n \"idempotencyKey\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"source\": {\n \"type\": \"account\",\n \"id\": \"1017381855\"\n },\n \"destination\": {\n \"type\": \"verified_blockchain\",\n \"addressId\": \"c7d8e9f0-a1b2-3456-7890-abcdef123456\"\n },\n \"amount\": {\n \"amount\": \"50.00\",\n \"currency\": \"USD\"\n },\n \"riskSignals\": {\n \"ipAddress\": \"203.0.113.42\",\n \"sessionId\": \"sess_abcdefghij\",\n \"deviceId\": \"dev_klmnopqrst\"\n }\n },\n \"ceremonyKind\": \"webauthn\",\n \"pathParameters\": {\n \"id\": \"a1b2c3d4-e5f6-7890-ab12-cdef34567890\"\n },\n \"embedOrigin\": \"https://app.example.com\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.circle.com/v1/accounts/passkeys/challenges")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"clientEntityId\": \"entity_01234567890abcdef\",\n \"operation\": \"TRANSFER\",\n \"intent\": {\n \"idempotencyKey\": \"550e8400-e29b-41d4-a716-446655440000\",\n \"source\": {\n \"type\": \"account\",\n \"id\": \"1017381855\"\n },\n \"destination\": {\n \"type\": \"verified_blockchain\",\n \"addressId\": \"c7d8e9f0-a1b2-3456-7890-abcdef123456\"\n },\n \"amount\": {\n \"amount\": \"50.00\",\n \"currency\": \"USD\"\n },\n \"riskSignals\": {\n \"ipAddress\": \"203.0.113.42\",\n \"sessionId\": \"sess_abcdefghij\",\n \"deviceId\": \"dev_klmnopqrst\"\n }\n },\n \"ceremonyKind\": \"webauthn\",\n \"pathParameters\": {\n \"id\": \"a1b2c3d4-e5f6-7890-ab12-cdef34567890\"\n },\n \"embedOrigin\": \"https://app.example.com\"\n}"
response = http.request(request)
puts response.read_body{
"data": {
"challengeId": "b2c3d4e5-f6a7-8901-bc23-def456789012",
"frameToken": "k74ia-AcnTzXtBdxnbVqn1IBpVUXBbhGiGxQkGD386A",
"expiresAt": "2026-09-24T12:05:00Z",
"summary": {
"type": "transfer",
"amount": {
"amount": "50.00",
"currency": "USD"
},
"destination": "1001587127",
"sourceAccountLabel": "My DAA account"
}
}
}{
"code": 2,
"message": "API parameter invalid."
}{
"code": 4,
"message": "Unauthorized."
}{
"code": 2,
"message": "API parameter invalid.",
"externalMessage": "The provided amount exceeds the maximum allowed.",
"errors": [
{
"error": "invalid_value",
"message": "The operation and assetType combination is invalid.",
"location": "assetType"
}
]
}{
"code": -1,
"message": "Something went wrong. errId: 1f0b0c455e40f753f07b4f0ae6abd4b4"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
The end-user identifier initiating the operation.
Example:
"entity_01234567890abcdef"
The operation type this challenge authorizes.
Available options:
TRANSFER, WITHDRAWAL, ADDRESS_BOOK_ADD, ADDRESS_BOOK_DELETE, WIRE_ACCOUNT_CREATE Example:
"TRANSFER"
The exact request body you will send to the protected endpoint. Every field and value must match — an extra or missing field causes an intent mismatch error (420047).
Example:
{ "idempotencyKey": "550e8400-e29b-41d4-a716-446655440000", "source": { "type": "account", "id": "1017381855" }, "destination": { "type": "verified_blockchain", "addressId": "c7d8e9f0-a1b2-3456-7890-abcdef123456" }, "amount": { "amount": "50.00", "currency": "USD" }, "riskSignals": { "ipAddress": "203.0.113.42", "sessionId": "sess_abcdefghij", "deviceId": "dev_klmnopqrst" } }
The ceremony type to use. Defaults to "webauthn". Any other value, including "spc", is rejected — a typo cannot silently downgrade a ceremony to a weaker mechanism.
Example:
"webauthn"
Path parameters for the protected endpoint, if any. Required for ADDRESS_BOOK_DELETE (provide id). Omit for all other operations.
Example:
{ "id": "a1b2c3d4-e5f6-7890-ab12-cdef34567890" }
The origin of your page that embeds the SCA ceremony, for example https://app.example.com. It must exactly match one of the origins approved for your account (scheme, host, and port; no trailing slash or path). Send it on every call. It is required when more than one origin is approved for your account: without it, the request fails with 400. When only one origin is approved, omitting it uses that origin. A blank value, or one that matches none of your approved origins, also fails with 400. The SCA ceremony is bound to this origin: when it is embedded, it can only be completed inside a page on this origin, and it posts its result only to this origin. If this origin is removed from your approved origins before the ceremony completes, the ceremony fails.
Required string length:
1 - 512Example:
"https://app.example.com"
Response
Successfully created an SCA challenge.
Show child attributes
Show child attributes
Was this page helpful?