--- title: Priority Host Authentication with Ephemeral Key (EK) description: Priority Host Authentication with Ephemeral Key (EK) --- [Skip to content](https://portal.sandgrain.eu/knowledge-base/api/priority-host-authentication-with-ephemeral-key-ek#main-content) English Show submenu for translations ![SandGrain\_Logo\_RGB\_white-bijgesneden (1)](https://portal.sandgrain.eu/hs-fs/hubfs/SandGrain_Logo_RGB_white-bijgesneden%20(1).png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png) Open main navigation Close main navigation - English Show submenu for translations - [Contact us](https://portal.sandgrain.eu/login) [Contact us](https://portal.sandgrain.eu/login?hsLang=en) How can we help you? - There are no suggestions because the search field is empty. 1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en) 2. [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en) 3. [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration) October 6, 2026 # Priority Host Authentication with Ephemeral Key (EK)   This is the **priority** (immediate) variant of host device authentication with an ephemeral key. Unlike the standard flow, which returns a `transactionId` to poll for the result, this endpoint performs authentication **synchronously** and returns the authentication result directly in a single call — no status polling required. The device submits its TID together with the host challenge word (HCW), host response word (HRW), and a `recipientPublicKey`. The server validates them and immediately returns the result, a **claim token** (when applicable), and an **ephemeral key (EK)** protected for the supplied public key. The flow uses a single endpoint: - **`POST /api/device/EKPriorityHostAuth`** — submit TID, HCW, HRW, and `recipientPublicKey`; receive the authentication result, `claimTokenId`, and `EK` in the response. Every request must be authenticated at the edge with Cloudflare Access headers (see below). ### Authentication headers The endpoint requires the following Cloudflare Access service-token headers on every request: | Header | Required | Description | | --- | --- | --- | | `CF-Access-Client-Id` | Yes | Your Cloudflare Access client ID. | | `CF-Access-Client-Secret` | Yes | Your Cloudflare Access client secret. | If these headers are missing or invalid, the request is rejected with `403 Forbidden`. --- ### Authenticate (single call) Submit the device token ID (TID), the host challenge word (HCW), the host response word (HRW), and the recipient's public key. The response returns the authentication result immediately. #### **Request** ``` POST /api/device/EKPriorityHostAuth Content-Type: application/json CF-Access-Client-Id: CF-Access-Client-Secret: ``` #### **Request body** ``` { "requestSignedResponse": false, "recipientPublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END PUBLIC KEY-----", "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef", "HCW": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "HRW": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" } ``` | Field | Type | Description | | --- | --- | --- | | `TID` | string | The device token ID. Must be exactly **64 characters** long. | | `HCW` | string | The host challenge word. | | `HRW` | string | The host response word. | | `recipientPublicKey` | string | A PEM-encoded RSA public key. The ephemeral key (EK) is protected for this recipient. | | `requestSignedResponse` | boolean | Set to `true` to request a signed response. | #### **Response — `200 OK`** ``` { "status": "AUTH_OK", "claimTokenId": "123e4567-e89b-12d3-a456-426614174000", "EK": "cccccccccccccccccccccccccccccccc" } ``` | Field | Type | Description | | --- | --- | --- | | `status` | string | The result of the authentication process. See possible values below. | | `claimTokenId` | string (UUID) | The claim token ID, returned when the status is `CLAIM_TOKEN`. | | `EK` | string | The ephemeral key, protected for the `recipientPublicKey` supplied in the request. | #### **Status values** | Value | Meaning | | --- | --- | | `AUTH_OK` | Authentication succeeded. | | `AUTH_NOT_OK` | Authentication failed. | | `CLAIM_TOKEN` | A token is ready to be claimed; use the returned `claimTokenId`. | #### **Errors** | Code | Meaning | | --- | --- | | `401 Unauthorized` | Authentication failed. | | `403 Forbidden` | Invalid request, commonly caused by an invalid Cloudflare Access token. | --- ### Related articles - Host Authentication with Ephemeral Key (EK) — the standard (polled) host auth EK flow (`EKRequestHostAuth`, `EKCheckRequestHostAuthStatus`) - Token Authentication with Ephemeral Key (EK) — the challenge/response EK flow (`EKRequestCW`, `EKReplyRW`, `EKCheckAuthStatus`) - Cloudflare Access service tokens — generating your `CF-Access-Client-Id` and `CF-Access-Client-Secret` - Claiming a token after `CLAIM_TOKEN` | [← Host Authentication with Ephemeral Key (EK)](https://portal.sandgrain.eu/knowledge-base/api/host-authentication-with-ephemeral-key-ek?hsLang=en) | [Host Response Word Request →](https://portal.sandgrain.eu/knowledge-base/api/request-rw?hsLang=en) | | --- | --- | - [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content) - [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide) - [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual) - [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper) - [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet) - [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure) - [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain) - [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note) - [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention) - [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk) - [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge) - [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content) - [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration) - [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation) - [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content) - [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions) - [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk) [![SandGrain\_Logo\_RGB\_white-bijgesneden (1)-1](https://portal.sandgrain.eu/hs-fs/hubfs/SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en) [mailto:email@email.com](mailto:email@email.com) Copyright © 2026, sandgrain.eu