Five-minute quickstart

Create your first authentication request

Use server-side Basic credentials only on your backend. The response gives the physical-card client a request-scoped token; your API secret never enters a browser or app.

1. Get sandbox credentials

Request a sandbox key. Sandbox is zero-rated and accepts synthetic test material only. Save the one-time keyId and keySecret in your backend secret store.

2. Create an audience-bound request

curl --user "$ATK_KEY_ID:$ATK_KEY_SECRET" \
  --header "Content-Type: application/json" \
  --data '{"audience":"https://app.example.lt","method":"physical"}' \
  https://atk.tvarka.pro/v1/auth/requests

The audience must exactly match an origin approved for your provider. A successful response is HTTP 202 and contains requestId, clientToken, verificationCode, status, and expiresAt.

3. Complete the card ceremony

Pass only requestId and clientToken to the device. Use the web/device SDK to read the authentication certificate, obtain the exact data-to-be-signed, and return the card signature after local PIN entry. CAN and PIN stay on the device.

4. Verify the result

Poll GET /v1/auth/{requestId} from your backend or consume the HMAC-signed terminal webhook. Re-derive the atk-auth-v1 challenge from your own audience and returned nonce, then verify the signature against the returned certificate. The auth reference documents the exact construction.