One real, live-verified endpoint — Pattern A's confirm callback. For what BYOAM is, how to register a method, and the full webhook contract for Pattern B, see BYOAM — this page is the raw call only, not a re-explanation of the pattern.
POST /api/v1/external-auth/confirm
Authorization: Bearer th_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-Threshold1-Signature: <hex HMAC-SHA256 of the raw body, keyed by your registration's secret>
Content-Type: application/json
{
"externalUserId": "your_user_123",
"method": "your_registered_method_name",
"verifiedAt": "2026-08-25T18:10:16.342Z",
"email": "user@example.com"
}
email is optional after the first call for a given externalUserId — required only to create a brand-new user. verifiedAt must be within 60 seconds of when threshold1 receives the request. Sign the exact raw bytes you send — re-serializing after computing the signature changes the bytes and breaks verification.
Real response, captured live with a real registration and a real computed signature:
{
"success": true,
"token": "eyJhbGciOiJIUzI1NiJ9...",
"userId": "5cfcde21-a69f-4c13-ae0a-076e9b4d0a70",
"externalUserId": "apiref_byoam_user_1",
"isNewUser": true
}
A real session — identical shape to every other login endpoint in this API.
Real, captured with a deliberately wrong signature:
{ "success": false, "error": "INVALID_SIGNATURE", "code": "INVALID_SIGNATURE" }
401