> ## Documentation Index
> Fetch the complete documentation index at: https://docs-api.kravata.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a PIN challenge

> Creates a single-use `flowToken` (5 minutes) for the WhatsApp PIN Flow, bound to this user session. Send the Flow with it; when the user enters the right PIN, send the operation with the **same user token within 120 seconds**. One confirmation authorizes one operation. Wrong PINs count toward the same 3-attempt lock as the widget.

#### Authentication

The **user token** returned by *Verify the OTP*, in both headers: `Authorization: Bearer <user token>` and `Cookie: accessToken=<user token>`.

See the [WhatsApp channel guide](/stack/whatsapp-channel) for the full flow.

#### Errors

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | - | Invalid `purpose`. |
| 404 | - | The user has no PIN: send them to the widget to create it. |



## OpenAPI

````yaml /stack/openapi.json post /api/v1/pin/challenge
openapi: 3.1.0
info:
  title: Kravata Stack API
  version: '2.0'
  description: >-
    Kravata Stack API: users, accounts, custody wallets, liquidity ramps and
    fiat payments.
servers:
  - url: https://test-api-kore.kravata.co
    description: Test
  - url: https://partners-api.kravata.co
    description: Production (mTLS + IP allowlist)
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Users
  - name: Accounts
  - name: Earn
  - name: Custody
  - name: Liquidity Ramps
  - name: Payments
  - name: Webhooks
  - name: Request Logs
  - name: WhatsApp Channel
    description: >-
      Endpoints for a company's own WhatsApp bot acting for one end user at a
      time. See the WhatsApp channel guide.
paths:
  /api/v1/pin/challenge:
    servers:
      - url: https://test-api-kore.kravata.co
        description: Test
      - url: https://api-kore.kravata.co
        description: Production (user token, no mTLS)
    post:
      tags:
        - WhatsApp Channel
      summary: Create a PIN challenge
      description: >-
        Creates a single-use `flowToken` (5 minutes) for the WhatsApp PIN Flow,
        bound to this user session. Send the Flow with it; when the user enters
        the right PIN, send the operation with the **same user token within 120
        seconds**. One confirmation authorizes one operation. Wrong PINs count
        toward the same 3-attempt lock as the widget.


        #### Authentication


        The **user token** returned by *Verify the OTP*, in both headers:
        `Authorization: Bearer <user token>` and `Cookie: accessToken=<user
        token>`.


        See the [WhatsApp channel guide](/stack/whatsapp-channel) for the full
        flow.


        #### Errors


        | Status | Code | Meaning |

        | --- | --- | --- |

        | 400 | - | Invalid `purpose`. |

        | 404 | - | The user has no PIN: send them to the widget to create it. |
      operationId: pin-challenge
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - purpose
                - summary
              properties:
                purpose:
                  type: string
                  description: '`withdrawal`, `account_creation` or `account_update`.'
                  example: withdrawal
                summary:
                  type: string
                  description: Text the user sees in the Flow, up to 160 characters.
                  example: Retiro de 100.000 COP a Bancolombia ****4321
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                required:
                  - flowToken
                properties:
                  flowToken:
                    type: string
                    description: Use it as `flow_token` when sending the Flow.
                  expiresIn:
                    type: integer
                    description: Seconds.
                    example: 300
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Access token from POST /api/v1/client/token.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.