Authorization

No API key or access token is required. This sign-in operation validates the registered application and challenge proof.

Application and challenge validation

Request headers

Content-Typeapplication/json: Encode the request body as JSON.

Request body

applicationIdstring · required: Public identifier for a registered tenant application. Not a secret.
emailstring · required: The enrolled or invited identity’s contact address.
codeChallengestring · required: Base64url SHA-256 digest of a fresh random proof-key verifier.
codeChallengeMethodstring · required: The codeChallengeMethod values for this request.Allowed: S256

Response

202Accepted

The challenge ID and expiry are returned. The response does not reveal whether the identity is enrolled.

Behavior to account for

No API key is used. Application registration does not authenticate a person. Rate limits, proof-key binding, expiry, and single-use verification protect this flow.

Return the same accepted response for known and unknown identities. Send a code only for an enrolled or invited managed identity. Email matching must not attach existing traveler records.

Errors

Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.

Error handling guide

curl --request POST 'https://api.wincora.com/api/v1/auth/challenges' \ --header 'Content-Type: application/json' \ --data '{ "applicationId": "app_example", "email": "alex@example.com", "codeChallenge": "BASE64URL_SHA256_OF_YOUR_VERIFIER", "codeChallengeMethod": "S256" }'

const response = await fetch('https://api.wincora.com/api/v1/auth/challenges', { method: 'POST', headers: { "Content-Type": "application/json" }, body: JSON.stringify({ "applicationId": "app_example", "email": "alex@example.com", "codeChallenge": "BASE64URL_SHA256_OF_YOUR_VERIFIER", "codeChallengeMethod": "S256" }) }); if (!response.ok) throw new Error(await response.text()); const result = await response.json();

import os import requests response = requests.request( 'POST', 'https://api.wincora.com/api/v1/auth/challenges', headers={ "Content-Type": "application/json" }, json={ "applicationId": "app_example", "email": "alex@example.com", "codeChallenge": "BASE64URL_SHA256_OF_YOUR_VERIFIER", "codeChallengeMethod": "S256" }, timeout=30, ) response.raise_for_status() result = response.json()