---
updatedAt: 2026-05-13T12:01:40.000Z
agentTools:
  projectIndex: https://docs.scaut.com/llms.txt
---

# Finish SMS OTP login

Complete SMS OTP authentication flow

# OpenAPI definition

```json
{
  "openapi": "3.0.3",
  "info": {
    "title": "Scaut REST API",
    "description": "Comprehensive REST API gateway for the Scaut platform, providing secure endpoints for authentication, order management, and business operations. Features include multi-factor authentication with passkey support (WebAuthn), Stripe payment integration, VAT validation, internationalization, and webhook handling. All protected endpoints require Bearer token or API key authentication.",
    "version": "1.0.0",
    "contact": {
      "name": "Scaut s.r.o.",
      "url": "https://scaut.com"
    },
    "license": {
      "name": "Scaut s.r.o.",
      "url": "https://scaut.com"
    }
  },
  "tags": [
    {
      "name": "Auth",
      "description": "Authentication endpoints"
    }
  ],
  "paths": {
    "/auth/sms-otp/login-finish": {
      "post": {
        "tags": [
          "Auth"
        ],
        "summary": "Finish SMS OTP login",
        "description": "Complete SMS OTP authentication flow",
        "requestBody": {
          "description": "SMS OTP login finish request with verification code",
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "description": "SMS OTP login finish request with verification code",
                "additionalProperties": false,
                "type": "object",
                "required": [
                  "phoneNumber",
                  "code"
                ],
                "properties": {
                  "phoneNumber": {
                    "minLength": 9,
                    "maxLength": 20,
                    "description": "User's phone number",
                    "type": "string"
                  },
                  "code": {
                    "minimum": 100000,
                    "maximum": 999999,
                    "description": "6-digit OTP verification code",
                    "type": "number"
                  }
                }
              }
            },
            "application/x-www-form-urlencoded": {
              "schema": {
                "description": "SMS OTP login finish request with verification code",
                "additionalProperties": false,
                "type": "object",
                "required": [
                  "phoneNumber",
                  "code"
                ],
                "properties": {
                  "phoneNumber": {
                    "minLength": 9,
                    "maxLength": 20,
                    "description": "User's phone number",
                    "type": "string"
                  },
                  "code": {
                    "minimum": 100000,
                    "maximum": 999999,
                    "description": "6-digit OTP verification code",
                    "type": "number"
                  }
                }
              }
            },
            "multipart/form-data": {
              "schema": {
                "description": "SMS OTP login finish request with verification code",
                "additionalProperties": false,
                "type": "object",
                "required": [
                  "phoneNumber",
                  "code"
                ],
                "properties": {
                  "phoneNumber": {
                    "minLength": 9,
                    "maxLength": 20,
                    "description": "User's phone number",
                    "type": "string"
                  },
                  "code": {
                    "minimum": 100000,
                    "maximum": 999999,
                    "description": "6-digit OTP verification code",
                    "type": "number"
                  }
                }
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Response for status 200",
            "content": {
              "application/json": {
                "schema": {
                  "anyOf": [
                    {
                      "description": "JWT token pair response after successful authentication",
                      "additionalProperties": false,
                      "type": "object",
                      "required": [
                        "accessToken",
                        "refreshToken"
                      ],
                      "properties": {
                        "accessToken": {
                          "description": "JWT access token for API authentication",
                          "type": "string"
                        },
                        "refreshToken": {
                          "description": "JWT refresh token for obtaining new access tokens",
                          "type": "string"
                        },
                        "email": {
                          "description": "Email address of the authenticated user",
                          "format": "email",
                          "type": "string"
                        }
                      }
                    },
                    {
                      "type": "object",
                      "required": [
                        "requiresMfa",
                        "mfaToken",
                        "availableMethods",
                        "expiresIn",
                        "canTrustDevice"
                      ],
                      "properties": {
                        "requiresMfa": {
                          "description": "Indicates that 2FA is required (always true for MFA challenge responses)",
                          "type": "boolean"
                        },
                        "mfaToken": {
                          "description": "Temporary MFA challenge token (valid for 5 minutes)",
                          "type": "string"
                        },
                        "availableMethods": {
                          "description": "Available second factor methods for this user",
                          "type": "array",
                          "items": {
                            "description": "Available second factor methods: totp, emailOtp, smsOtp, backupCodes",
                            "type": "string"
                          }
                        },
                        "preferredMethod": {
                          "description": "Preferred method (if user has set one): totp, emailOtp, smsOtp, or backupCodes",
                          "type": "string"
                        },
                        "expiresIn": {
                          "description": "When the challenge expires (in seconds)",
                          "type": "number"
                        },
                        "canTrustDevice": {
                          "description": "Whether this device can be trusted (if user has enabled trusted devices)",
                          "type": "boolean"
                        }
                      }
                    }
                  ]
                }
              }
            }
          }
        },
        "operationId": "postAuthSms-otpLogin-finish"
      }
    }
  }
}
```