---
title: "Start branded email-code guest authentication"
description: "Creates an email OTP challenge bound to this installation, collection, exact Kismet identity anchor (`kidSid`), and a branded host authorized through Collection.authorizedDomains. Requires a server (`sk_`) credential and a same-origin BFF CSRF proof. The response includes child-brand auth presentation with missing fields inherited only from the nearest cycle-safe SUB_BRAND parent. TEST installations never send email: registered test recipients receive a deterministic verification code in this authenticated server response; all other addresses receive the same accepted response without a usable code."
---

`POST /v1/developer/guest-auth/challenges`

**Operation ID:** `challengeDeveloperGuestAuth`

Creates an email OTP challenge bound to this installation, collection, exact Kismet identity anchor (`kidSid`), and a branded host authorized through Collection.authorizedDomains. Requires a server (`sk_`) credential and a same-origin BFF CSRF proof. The response includes child-brand auth presentation with missing fields inherited only from the nearest cycle-safe SUB_BRAND parent. TEST installations never send email: registered test recipients receive a deterministic verification code in this authenticated server response; all other addresses receive the same accepted response without a usable code.

## Contract status

| Field | Value |
| --- | --- |
| Maturity | `beta` |
| Required capability | `guest_auth.write` |
| Freshness class | `sandbox-write` |
| Quota cost | `1` |
| Operational owner | Identity + Developer Experience |

All operations require a Kismet Developer Bearer credential. Collection and resource authority is resolved from the credential's installation grants; identifiers in the URL never grant access.

## Request parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `x-kismet-csrf` | header | string | yes | Opaque CSRF proof validated by the same-origin host BFF before it calls Kismet. Never a Kismet credential. |
| `origin` | header | string | no | Original branded browser origin forwarded by the same-origin BFF. Must match Collection.authorizedDomains. |
| `x-forwarded-host` | header | string | no | Original branded host fallback for server route handlers that do not forward Origin. Must match Collection.authorizedDomains. |

## Request body

The request body is JSON. The canonical schema is:

```json
{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "email",
    "kidSid"
  ],
  "properties": {
    "email": {
      "type": "string",
      "minLength": 3,
      "maxLength": 254
    },
    "kidSid": {
      "type": "string",
      "pattern": "^kid_[A-Za-z0-9]{8}$"
    }
  }
}
```

Minimal example:

```json
{
  "email": "developer-test@example.com",
  "kidSid": "kid_Ab12Cd34"
}
```

## cURL

```sh
curl --request POST \
  "$KISMET_API_ORIGIN/v1/developer/guest-auth/challenges" \
  --header "Authorization: Bearer $KISMET_DEVELOPER_API_KEY" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '{"email":"developer-test@example.com","kidSid":"kid_Ab12Cd34"}'
```

## Responses

| Status | Meaning |
| --- | --- |
| 202 | Accepted without revealing whether the identity is registered. |
| 400 | Invalid request parameters or body. |
| 401 | Missing, invalid, expired, or inappropriate credential/session. |
| 403 | Credential lacks the required grant/capability, or an origin/CSRF check failed. |
| 429 | Rate limit or quota exceeded; inspect response metadata before retrying. |
| 503 | A required Kismet dependency is temporarily unavailable. |

### Success example

```json
{
  "accepted": true,
  "challengeId": "66666666-6666-4666-8666-666666666666",
  "expiresAt": "2026-08-18T18:05:00.000Z",
  "testVerificationCode": "042817",
  "branding": {
    "displayName": "Sandbox Vacation Rentals",
    "logoUrl": "https://cdn.kismet.travel/sandbox/logo.svg",
    "faviconUrl": "https://cdn.kismet.travel/sandbox/favicon.ico",
    "supportEmail": "support@example.invalid",
    "policyLinks": {
      "termsUrl": "https://example.invalid/terms",
      "privacyUrl": "https://example.invalid/privacy"
    },
    "accountProvider": "Kismet"
  }
}
```

## Machine-readable sources

- [This page as Markdown](/api/reference/challenge-developer-guest-auth.md)
- [Developer API OpenAPI v0.7.0](/openapi.json)