Skip to main content
Applies only to customers in an SCA-required region (EU). Every endpoint here returns 409 for other customers.
Trusting a beneficiary is a one-time, SCA-gated step that whitelists an external account. Only USDC addresses can be trusted today. Once trusted, future sends to that payee are no longer dynamically linked; they drop to a lighter authentication instead of a full per-transaction challenge. Use it for recurring payouts to known destinations. The beneficiary is identified end-to-end by its externalAccountId in the path, so there is no separate whitelist handle to track. All paths below are relative to https://api.lightspark.com/grid/2025-10-13.

​
Trusting a beneficiary

1

Start the trust

Returns the scaChallenge to satisfy:
scaChallenge may be omitted when no challenge is issued. In that case, confirm directly without a challengeId.
2

Confirm the trust

Submit the proof for the factor Grid returned in scaChallenge: code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY. Echo challengeId when start issued one. Do not assume a factor is available unless it appears in scaChallenge.availableFactors.
An invalid or expired proof returns 400. In sandbox, the code is always 123456.

​
Untrusting a beneficiary

Untrusting mirrors trusting: a start call issues the challenge, then confirm submits the proof.
1

Start the untrust

Returns the scaChallenge to satisfy, omitted when no challenge is issued (the caller then confirms without a challengeId).
2

Confirm the untrust

Submit the proof for the factor Grid returned in scaChallenge: code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY. Echo challengeId when start issued one. Returns trusted: false.
Once untrusted, sends to that beneficiary are dynamically linked again and each one requires a full per-transaction challenge.