> ## Documentation Index
> Fetch the complete documentation index at: https://docs.confiroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a SEP-10 challenge

> Returns a challenge XDR for the given account to sign with its wallet. Single-use, expires in 5 minutes.



## OpenAPI

````yaml /openapi.yaml get /auth/sep10/challenge
openapi: 3.1.0
info:
  title: Confiroll payroll-api
  version: 1.0.0
  description: >
    The Confiroll BFF (backend-for-frontend) for confidential contractor payroll
    on Stellar **testnet**. It issues session JWTs (SEP-10 wallet or Privy
    email) and fee-bumps browser-signed confidential transfers (Fork B). It
    holds operational keys only, never a user's signing or viewing key.


    Every handled error returns `{ "error": string }`. Request bodies are
    limited to 256 KiB.
servers:
  - url: https://api.confiroll.com
    description: Live testnet deployment
security: []
tags:
  - name: Health
    description: Service health.
  - name: Auth
    description: Session issuance via SEP-10 (wallet) or Privy (email).
  - name: Transfers
    description: The core confidential-payout call (Fork B fee-bump).
  - name: Batch runs
    description: Run a confidential batch of payouts.
  - name: Withdrawals and disclosure
    description: >-
      Withdraw and auditor disclosure. These routes return 501; the operations
      run in the client tooling.
  - name: Session and role
    description: Resolves the signed-in user's role.
  - name: Contractors
    description: Contractor directory (public data only).
  - name: Batches
    description: SDP-aligned batch (disbursement) records.
  - name: Payouts
    description: SDP-aligned payout (payment) records.
  - name: Funding
    description: Faucet and CCTP vault state.
paths:
  /auth/sep10/challenge:
    get:
      tags:
        - Auth
      summary: Get a SEP-10 challenge
      description: >-
        Returns a challenge XDR for the given account to sign with its wallet.
        Single-use, expires in 5 minutes.
      parameters:
        - name: account
          in: query
          required: true
          schema:
            type: string
          description: The Stellar G-address signing in.
          example: GCA6G5437RCAQ4IED5PXTGTOADEQ3RYPEDTNHFPXAJTBTVU5DLLX7V4M
      responses:
        '200':
          description: Challenge issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Challenge'
        '400':
          description: Missing or invalid account
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              examples:
                missing:
                  value:
                    error: account required
                invalid:
                  value:
                    error: invalid Stellar account
components:
  schemas:
    Challenge:
      type: object
      properties:
        transaction:
          type: string
          description: Base64 SEP-10 challenge XDR for the wallet to sign.
        network_passphrase:
          type: string
          examples:
            - Test SDF Network ; September 2015
      required:
        - transaction
        - network_passphrase
    Error:
      type: object
      description: Standard error shape for all handled errors.
      properties:
        error:
          type: string
          description: Human-readable message.
      required:
        - error

````