POST /api/v1/auth/oidc/challenge

OpenID Connect sign-in, step 4: the redemption secret for one nonce.

After the completion page reported ok, the page sends the flow and its redemption secret and receives ONE nonce, which its mint proof must carry. A second request while a nonce is outstanding is refused. Every refusal is the same TRANSACTION_UNKNOWN: an unknown flow, a wrong secret and an unverified sign-in are indistinguishable, and a wrong secret changes nothing.

Authentication

No session required. This operation is reachable without an Authorization header. See Authenticating.

Request

Field	Type	Required	Description
flowId	string	yes
redemptionSecret	string	yes	The secret whose SHA-256 step 1 committed to.

Example

{
  "flowId": "...",
  "redemptionSecret": "..."
}

Responses

200

One nonce for the mint proof.

Field	Type	Required	Description
nonce	string	yes
expiresAt	string	yes

Example

{
  "nonce": "...",
  "expiresAt": "..."
}

401

TRANSACTION_UNKNOWN.

413

PAYLOAD_TOO_LARGE (retryable: false) -- the request body is larger than this deployment accepts. It was refused before it was parsed, and the connection is closed. Nothing was sent to the key server.

429

LOGIN_RATE_LIMITED (Retry-After) -- the configured redemption attempts per minute are spent. Or RATE_LIMITED, the per-source login allowance.

503

SSO_CAPACITY (Retry-After) -- the Gateway cannot hold another sign-in nonce. OIDC_NOT_CONFIGURED (Retry-After). Or CAPACITY_UNAVAILABLE.

Error handling

Every failure answers JSON carrying at least code and detail. Match on code — detail is written for a human debugging the call and its wording is not part of the contract. See the error model.

Status	Meaning
401	TRANSACTION_UNKNOWN.
413	PAYLOAD_TOO_LARGE (retryable: false) -- the request body is larger than this deployment accepts. It was refused before it was parsed, and the connection is closed. Nothing was sent to the key server.
429	LOGIN_RATE_LIMITED (Retry-After) -- the configured redemption attempts per minute are spent. Or RATE_LIMITED, the per-source login allowance.
503	SSO_CAPACITY (Retry-After) -- the Gateway cannot hold another sign-in nonce. OIDC_NOT_CONFIGURED (Retry-After). Or CAPACITY_UNAVAILABLE.