Priority Host Response Word Request with Ephemeral Key (EK)

This is the priority (immediate) variant of the host response word request with an ephemeral key. Unlike the standard flow, which returns a transactionId to poll for the result, this endpoint returns the outcome directly in a single call.

The device submits its TID, the host challenge word (HCW), and a recipientPublicKey. The server generates the host response word (HRW) and an ephemeral key (EK) protected for the supplied public key, and returns them in the response along with a status.

The flow uses a single endpoint:

POST /api/device/EKPriorityRequestHRW — submit TID, HCW, and recipientPublicKey; receive the status, HRW, and EK in the response.

Note on status: because generation can occasionally still be in progress, the response may return PROCESSING or NOT_READY. In that case, retry the request. The HRW and EK are populated once the status is GENERATED_HRW.

Every request must be authenticated at the edge with Cloudflare Access headers (see below).

Authentication headers

The endpoint requires the following Cloudflare Access service-token headers on every request:

Header	Required	Description
`CF-Access-Client-Id`	Yes	Your Cloudflare Access client ID.
`CF-Access-Client-Secret`	Yes	Your Cloudflare Access client secret.

If these headers are missing or invalid, the request is rejected with 403 Forbidden.

Request a host response word (single call)

Submit the device token ID (TID), the host challenge word (HCW), and the recipient's public key. The response returns the HRW and EK immediately.

Request

POST /api/device/EKPriorityRequestHRW 
Content-Type: application/json 
CF-Access-Client-Id: <your-client-id> 
CF-Access-Client-Secret: <your-client-secret>

Request body

{   
     "requestSignedResponse": false,   
     "recipientPublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END PUBLIC KEY-----",   
     "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef",   
     "HCW": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" 
}

Field	Type	Description
`TID`	string	The device token ID. Must be exactly 64 characters long.
`HCW`	string	The host challenge word for which to generate a host response word.
`recipientPublicKey`	string	A PEM-encoded RSA public key. The ephemeral key (EK) is protected for this recipient.
`requestSignedResponse`	boolean	Set to `true` to request a signed response.

Response — `200 OK`

{   
     "status": "GENERATED_HRW",   
     "HRW": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",   
     "EK": "cccccccccccccccccccccccccccccccc" 
}

Field	Type	Description
`status`	string	The current state of the HRW request. See possible values below.
`HRW`	string	The generated host response word. Populated when the status is `GENERATED_HRW`.
`EK`	string	The ephemeral key, protected for the `recipientPublicKey` supplied in the request. Populated when the status is `GENERATED_HRW`.

Status values

Value	Meaning
`PROCESSING`	The request is still being processed. Retry the request.
`NOT_READY`	The result is not ready yet. Retry the request.
`AUTH_NOT_OK`	Authentication failed; no HRW or EK will be generated.
`GENERATED_HRW`	The host response word and ephemeral key have been generated and are returned in the `HRW` and `EK` fields.

Errors

Code	Meaning
`401 Unauthorized`	Authentication failed.
`403 Forbidden`	Invalid request, commonly caused by an invalid Cloudflare Access token.

Host Response Word Request with Ephemeral Key (EK) — the standard (polled) HRW EK flow (EKRequestHRW, EKCheckRequestHRWStatus)
Priority Host Authentication with Ephemeral Key (EK) — the immediate host auth flow (EKPriorityHostAuth)
Cloudflare Access service tokens — generating your CF-Access-Client-Id and CF-Access-Client-Secret

← Host Response Word Request with EK

Verification →