Skip to main content
POST
Mint a challenge
string
required
Bearer hrtc_sk_…
string
required
phone: the page runs the ceremony on the device that opens it. desktop: the page shows a QR code that hands off to a phone.
string
Your account handle, up to 128 characters. A device already registered to another account_ref cannot register again.
integer
default:"600"
120 to 900.
The widget mints ceremonies on its own. This endpoint mints one from your backend, for a visitor your own rule flagged. Read the outcome at GET /v1/challenge/{challenge_id}.

Request

Response

Show the ceremony

As a modal on your page. With guard.js loaded:
The frame closes when the ceremony reaches an outcome, then callback runs. On a phone the frame fills the screen. On a desktop it shows the QR hand-off and closes when the phone finishes. heretic.closeChallenge(id) closes it as a dismissal. In your own frame. Any origin may frame the page. Give the frame these permissions:
At an outcome the page posts { source: "heretic", type: "heretic-challenge", challenge_id, status, step_reached } to its parent. Check event.origin === "https://heretic.tech". As a redirect. Send the visitor to url and bring them back yourself. The message on the page is for the page. Your backend reads the outcome below before acting.

Status codes