Authentication with OTP Step Up
When an authentication attempt (End User Authentication or Consumer Authentication) is neither accepted nor rejected outright, relay may step the customer up to a one-time password (OTP) challenge sent to their verified phone. Your backend collects the code through your own UX and submits it back. Organizations never receive OTP — they are stepped up directly to KBA.
End User UXPartner Backendrelay API
Steps
-
Customer enters the required PII in your application.
-
Your backend collects the PII and device info and calls the registration endpoint for the customer type.
-
POST the customer-type registration endpoint:
- Consumer —
POST /api/experian/renters/{renterId} - End user (agent) —
POST /api/experian/agents/{agentId} - Organization —
POST /api/experian/organizations/{organizationId}
- Consumer —
-
On Accept, persist the authentication datetime. Authentication is valid for 365 days.
-
Display a success message (optional). On Reject, translate the response and render UX — the customer should have the option to retry, or, if a consumer, to submit without reports.
-
If the response indicates OTP step-up, relay requests the OTP (with KBA fallback) on your behalf. If no valid phone is on file, the customer is stepped up to KBA instead.
-
The OTP is sent directly to your customer.
-
Serve UX for the customer to enter the OTP — you must build this screen.
-
Customer enters the OTP in your application.
-
POST the entered OTP to the matching endpoint:
- Consumer —
POST /api/experian/renters/{renterId}/otp(resend:GET …/otp/resend) - End user (agent) —
POST /api/experian/agents/{agentId}/otp(resend:GET …/otp/resend) - Organizations never receive OTP — they are stepped up directly to KBA.
A valid OTP completes authentication (step 4); an invalid OTP follows the rejection path.
- Consumer —