Host endpoints
API reference
Two POST endpoints form the host integration surface: issue a one-time challenge, then verify its proof result.
POST /api/challenges
Creates 32 random bytes, stores only their digest, binds the record to trusted origin and gate, and expires it after five minutes.
ts
{"gateId":"premium-holder"}POST /api/verify
Validates and atomically consumes the challenge and login nullifier. A successful response contains only the documented VerifiedLogin fields.
json
{"ok":true,"privateAppId":"vp_appA_72f1","gateId":"premium-holder","epoch":20391,"origin":"https://app.example","expiresAt":"2026-08-02T09:00:00.000Z"}