Skip to main content
POST
/
v1
/
session
/
otp
Create standalone OTP
curl --request POST \
  --url https://{appId}.session.prelude.dev/v1/session/otp \
  --header 'Content-Type: application/json' \
  --data '
{
  "challenge_token": "<string>",
  "code_challenge": "<string>",
  "dispatch_id": "<string>",
  "login_config_id": "<string>"
}
'
{
  "code": "bad_request",
  "type": "bad_request"
}

Body

application/json

Either challenge_token or identifier must be provided. Use challenge_token for step-up flows, identifier for standalone OTP.

​
challenge_token
string
required

The challenge token from a step-up request.

Example:

"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."

​
identifier
object

The verification target. Either a phone number or an email address.

​
code_challenge
string

PKCE code challenge (S256) for the standalone OTP login flow. Only used with identifier; bound to the verification token so that code_verifier can be replayed against Finalize login. Step-up flows ignore this field — they inherit PKCE from the originating challenge token.

Example:

"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

​
dispatch_id
string

The identifier of the dispatch from the front-end SDK.

Example:

"123e4567-e89b-12d3-a456-426614174000"

​
login_config_id
string

The identifier of the login config to use.

Example:

"lcfg_01jqebhswje1ka1z7ahr9rfsgt"

Response

No Content