# Flowg8 · Complete sign-in

Complete the first-login password change or an MFA challenge through the API.

Copy challengeToken from the last challenge_required response; it expires after 180 seconds. For NEW_PASSWORD_REQUIRED send newPassword (14+ characters, mixed case, number and symbol, no spaces). For SMS_MFA, SOFTWARE_TOKEN_MFA or EMAIL_OTP send code instead. Never send both. Continue if a further challenge is returned. No token is issued before all mandatory challenges succeed.

## POST /v1/auth/challenge

Authentication: public account endpoint; no token required
Required user permissions: No account role required. The API checks current membership, roles, key scopes and resource permissions on every request. Documentation visibility grants no access.

## Input parameters
- challengeToken (string, required): min length 1 · max length 12000
- newPassword (string, optional): min length 1 · max length 256
- code (string, optional): 

## Request example (replace example IDs)

```sh
curl -X POST "https://api.flowg8.io/v1/auth/challenge" \
  -H "content-type: application/json" \
  --data-raw '{
  "challengeToken": "YOUR_CHALLENGE_TOKEN",
  "newPassword": "YOUR_NEW_PASSWORD"
}'
```

## Response excerpt

```json
{
  "status": "authenticated",
  "tokenType": "Bearer",
  "accessToken": "YOUR_FLOWG8_ACCESS_TOKEN",
  "expiresIn": 3600,
  "expiresAt": "2026-10-17T12:00:00.000Z"
}
```

Source: /docs/auth-challenge
Full schemas: /docs/openapi.json