Complete a project claim
Called by the browser after the developer authenticates on the claim page.
Authenticated by the session cookie, it attaches the project to
the developer's personal team using the challenge_id from the claim URL as
its single-use, browser-safe authorization.
sessionCookie__Host-zitadel_session<token>The session cookie issued at session creation or superseding handoff exchange.
A browser holds it as __Host-zitadel_session, with Secure. Over plain
http to a loopback host (localhost, 127.0.0.1, ::1) the server sets it
as zitadel_session instead, without Secure or the prefix, so that Safari
keeps it, and accepts that name there too; __Host-zitadel_session takes
precedence. A program sends __Host-zitadel_session over any transport.
A missing or invalid cookie yields 401 with code auth.unauthorized and the message
Missing or invalid session token.
Cross-site request forgery (ADR 053 §5): a state-changing request that this
cookie authenticates must come from the same origin — a cross-site browser
request is refused with 403 and code auth.csrf_invalid. Every such
request must also send the session's token from GET /sessions/me/csrf in the
X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are
the POST …/query reads, which need no token. Safe methods (GET) are not checked. A request a project secret
authenticates is not affected.
project_id*stringThe unique identifier of the project.
^[a-zA-Z0-9_-]+$application/json- body
The request to complete a project claim.
challenge_id*challenge-idUnique identifier for this challenge (dialect-minted prefixed opaque string).
^ch_[a-zA-Z0-9_-]+$Project claimed.
application/json- response
The result of a completed project claim.
project_id*project-id^[a-zA-Z0-9_-]+$team_id*team-id^[a-zA-Z0-9_-]+$claimed_at*stringThe time when the project was claimed.
date-timeimport { configureZitadel, getApi } from "@zitadel/api/config";import { setApiCsrfToken } from "@zitadel/api/runtime/auth";// In the browser, through the SDK proxy: the session cookie authenticates the call.const client = getApi(configureZitadel({ projectId: "proj_01KWH1P4MYS7F0N9WD3P2E4YM5" }));// A write the session cookie authenticates carries the session's CSRF token.setApiCsrfToken((await client.getMySessionCsrfToken()).csrf_token);const claim = await client.completeClaim( "proj_01KWH1P4MYS7F0N9WD3P2E4YM5", { challenge_id: "string" },);{ "project_id": "string", "team_id": "string", "claimed_at": "2019-08-24T14:15:22Z"}Was this helpful?