---
title: Token Authentication
description: Token Authentication
---
[Skip to content](https://portal.sandgrain.eu/knowledge-base/api/token-authentication#main-content)
English
Show submenu for translations
.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1).png)
Open main navigation
Close main navigation
- English
Show submenu for translations
- [Contact us](https://portal.sandgrain.eu/login)
[Contact us](https://portal.sandgrain.eu/login?hsLang=en)
How can we help you?
- There are no suggestions because the search field is empty.
1. [Knowledge Base](https://portal.sandgrain.eu/knowledge-base?hsLang=en)
2. [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en)
3. [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
October 6, 2026
# Token Authentication
### Request Challenge Word
Generates a challenge word using provided **TID**.
- Provide `TID`.
- Returns `CW` (challenge word) and a `transactionId`.
#### Method & Endpoint
**Method:** POST
**Endpoint:** `/api/device/requestCW`
**Headers:** `CF-Access-Client-ID` and `CF-Access-Client-Secret`
#### Request Body
```
{ "requestSignedResponse": false, "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef"}
```
#### ✅ Successful Response — 201 Created
```
{ "CW": "132764765ebdcaaefe8d2508f0b3098600deb9b3a2f2bfe30c4a285d262a396d", "transactionId": "BA782F0B-4E0F-EE11-A9B9-000D3A49003C"}
```
#### ❌ Error Responses
**400 Bad Request** — Invalid input
```
{ "statusCode": 400, "message": [ "TID must be exactly 64 characters long" ], "error": "Bad Request"}
```
**401 Unauthorized** — Invalid authentication
```
{ "statusCode": 401, "message": "Unauthorized"}
```
**403 Forbidden** — Authorization Forbidden
```
{ "statusCode": 403, "message": "Invalid request", "error": "Forbidden"}
```
**520 Web Server Returned an Unknown Error** — The origin server returned an empty, unknown, or unexpected response to Cloudflare.
---
### Reply Response Word
This endpoint accepts the **Challenge Word (CW)** and **transactionId** from the previous endpoint along with the **Response Word (RW)**, **TID**, **PCC**, and **ID**.
#### Method & Endpoint
**Method:** POST
**Endpoint:** `/api/device/replyRW`
**Headers:** `CF-Access-Client-ID` and `CF-Access-Client-Secret`
#### Request Body
```
{ "requestSignedResponse": false, "TID": "800000001000000010000000000000014464b592da61f3fd5506fcb1f37f4bef", "CW": "132764765ebdcaaefe8d2508f0b3098600deb9b3a2f2bfe30c4a285d262a396d", "RW": "e498a506be93008e40739a3077e4ad40", "transactionId": "c905f6b4-3239-417e-abd9-66fe66f43a2a"}
```
#### ✅ 200 OK: Success response
```
{ "transactionId": "BA782F0B-4E0F-EE11-A9B9-000D3A49003C"}
```
#### ❌ Error Responses
**401 Unauthorized** — Invalid authentication
```
{ "statusCode": 401, "message": "Unauthorized"}
```
**403 Forbidden** — Authorization Forbidden
```
{ "statusCode": 403, "message": "Invalid request", "error": "Forbidden"}
```
**520 Web Server Returned an Unknown Error** — The origin server returned an empty, unknown, or unexpected response to Cloudflare.
---
### Check Authentication Result
This endpoint is responsible for checking the authentication result. A valid **Transaction ID** is required to proceed.
#### Method & Endpoint
**Method:** GET
**Endpoint:**`/api/device/checkAuthStatus`
**Headers:** `Transaction ID, ``CF-Access-Client-ID` and `CF-Access-Client-Secret`
#### Request Body
*Not required*
#### ✅ 200 OK: Success response
```
{ "status": { "AUTH_OK": "AUTH_OK", "AUTH_NOT_OK": "AUTH_NOT_OK", "CLAIM_TOKEN": "CLAIM_TOKEN" }, "claimTokenId": "BA782F0B-4E0F-EE11-A9B9-000D3A49003C"}
```
#### Status Explanation
- **NOT\_READY:** Authenticating ID is processing or not ready
- **AUTH\_NOT\_OK:** Authenticated ID failed
- **AUTH\_OK:** Successfully authenticated ID (claimed before)
- **CLAIM\_ID:** Successfully authenticated ID ready for Tenant User to claim
#### ❌ Error Responses
**401 Unauthorized** — Invalid authentication
```
{ "statusCode": 401, "message": "Unauthorized"}
```
**403 Forbidden** — Authorization Forbidden
```
{ "statusCode": 403, "message": "Invalid request", "error": "Forbidden"}
```
**520 Web Server Returned an Unknown Error** — The origin server returned an empty, unknown, or unexpected response to Cloudflare.
| [← Authentication](https://portal.sandgrain.eu/knowledge-base/authentication?hsLang=en) | [Token Authentication with Ephemeral Key (EK) →](https://portal.sandgrain.eu/knowledge-base/token-authentication-with-ephemeral-key-ek?hsLang=en) |
| --- | --- |
- [User Documentation](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#main-content)
- [Quick Starter Guide](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#quick-starter-guide)
- [User Manual](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#user-manual)
- [Whitepaper](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#whitepaper)
- [Token Leaflet](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#token-leaflet)
- [Claim Token Procedure](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#claim-token-procedure)
- [Daisy Chain](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#daisy-chain)
- [Release Note](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#release-note)
- [Naming Convention](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#naming-convention)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#sandgrain-sdk)
- [TrustBridge](https://portal.sandgrain.eu/knowledge-base/user-documentation?hsLang=en#trustbridge)
- [API Documentation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#main-content)
- [Device API Integration](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#device-api-integration)
- [Daisy Chain and Attestation](https://portal.sandgrain.eu/knowledge-base/api-documentation?hsLang=en#daisy-chain-and-attestation)
- [SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#main-content)
- [Core Functions](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#core-functions)
- [SandGrain SDK](https://portal.sandgrain.eu/knowledge-base/sdk?hsLang=en#sandgrain-sdk)
[-1.png?width=427&height=83&name=SandGrain_Logo_RGB_white-bijgesneden%20(1)-1.png "SandGrain_Logo_RGB_white-bijgesneden (1)-1")](https://portal.sandgrain.eu/?hsLang=en)
[mailto:email@email.com](mailto:email@email.com)
Copyright © 2026, sandgrain.eu