getChallenge

Requests a challenge transaction from the authentication server.

This is the first step of the SEP-10 authentication flow. The server generates a challenge transaction specifically for the client account and returns it as base64-encoded XDR.

The challenge transaction:

• Has sequence number 0 (cannot be submitted to network)

• Contains ManageData operations with authentication metadata

• Is already signed by the server

• Has time bounds to prevent replay attacks

• Includes the home domain in the first operation

HTTP Request:

GET {authEndpoint}?account={clientAccountId}[&memo={memo}][&home_domain={homeDomain}][&client_domain={clientDomain}]

Example - Basic challenge request:

val challenge = webAuth.getChallenge(clientAccountId = "GACCOUNT...")
println("Challenge XDR: ${challenge.transaction}")

Example - With memo for sub-account:

val challenge = webAuth.getChallenge(
    clientAccountId = custodialAccountId,
    memo = 12345
)

Example - With client domain:

val challenge = webAuth.getChallenge(
    clientAccountId = "GACCOUNT...",
    clientDomain = "wallet.mycompany.com"
)

Security note: Always validate the returned challenge with validateChallenge before signing it. Never sign an unvalidiated challenge.

Parameters

Throws