> This page is for version v2 (default).
> For other versions, use one of these documentation indexes:
> - v2 (default): https://docs.pinnacle.sh/v-2/llms.txt
> - v1: https://docs.pinnacle.sh/v1/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pinnacle.sh/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pinnacle.sh/_mcp/server.

# Start Silent Authentication

POST https://api.pinnacle.sh/network/silent-auth
Content-Type: application/json

Start a Silent Authentication session to verify that the user controls the device attached to a phone number. Omit `format` to receive a `browserUrl` for the hosted browser/WebView flow, or set `format: "json"` to receive a `jsonUrl` for a native mobile app or custom client-side flow. The device check must run from the user's cellular device, not your server.

The returned URL expires 60 seconds after creation. Open or fetch it immediately and use `expiresAt` to detect when a new Silent Auth session is required.

Limited availability. Contact [founders@pinnacle.sh](mailto:founders@pinnacle.sh) to request access.

Reference: https://docs.pinnacle.sh/api-reference/network/start-silent-auth

## Authentication

- `PINNACLE-API-KEY` header (required) — API Key authentication via header

## Request

### Body (application/json)

This endpoint expects a SilentAuthRequest.

- `phoneNumber` (string, required) — Phone number in E.164 format, including country code.
- `clientRef` (string, optional) — Your correlation ID, such as a user ID, session ID, or case ID.
- `format` (enum, optional) — Set to `json` when you want to fetch `jsonUrl` directly from your app and receive a JSON response. Omit this field for the hosted browser/WebView flow.
  - Allowed values: `json`

## Response

### 200

Returns a short-lived URL for completing Silent Authentication from the user's device.

- `SilentAuthResponse`
  - `format`: `hosted` (hosted)
    - `browserUrl` (string, required) — URL to open on the user's cellular device when Pinnacle should handle the browser/WebView flow.
    - `expiresAt` (string, required) — Expiration timestamp for the initial Silent Auth device handoff. Silent Auth URLs expire 60 seconds after creation and should be opened immediately from the user's cellular device.
    - `requestId` (string, required) — Unique Pinnacle ID for a Network API request.
  - `format`: `json` (json)
    - `expiresAt` (string, required) — Expiration timestamp for the initial Silent Auth device handoff. Silent Auth URLs expire 60 seconds after creation and should be fetched immediately from the user's cellular device.
    - `jsonUrl` (string, required) — URL to fetch from the user's cellular device with redirects enabled. The final response contains a verification code.
    - `requestId` (string, required) — Unique Pinnacle ID for a Network API request.

## Errors

### 400 Bad Request Error

The request was unacceptable, often due to providing an invalid update.  Errors may originate from invalid payload or from Pinnacle's additional validation checks. For example, providing an URL that cannot be accessed, updating a campaign that is currently being reviewed, updating data that you cannot access, sending a malformed message, and so on.  For `Pinnacle Validation Error` inspect the `error` payload to determine the source of the failure. These errors are likely due to additional validation and business logic checks. For `Request Validation Error` inspect the `description` and `errors` payload to determine the source of failure. These errors are likely due to invalid payload inside the request.

- `StartSilentAuthenticationRequestBadRequestError`

### 401 Unauthorized Error

The request lacks valid authentication credentials or the provided credentials are invalid.  Ensure you're including a valid API key in the request headers and that your account has the necessary permissions to access this endpoint.

- `error` (string, required) — Human-readable description of the error that occurred, corresponding to the HTTP status code.

### 403 Forbidden Error

Your subscription does not include access to this feature.  This occurs when attempting to use functionality that requires a higher subscription tier. Please upgrade your subscription to access this feature.

- `error` (string, required) — Human-readable description of the error that occurred, corresponding to the HTTP status code.

### 500 Internal Server Error

An unexpected error occurred on Pinnacle's servers while processing your request.  If this error persists, please contact support with the request details.

- `error` (string, required) — Human-readable description of the error that occurred, corresponding to the HTTP status code.

## Types

### ZodError

- `description` (string, required) — Human-readable summary of validation failures.
- `errors` (ZodErrorErrors, required) — Structured dictionary of issues containing two main sections: - `errors`: Array of global validation errors not tied to specific fields - `properties`: Object mapping field names to their specific validation errors, where each field contains an `errors` array

### Error

Standard error response returned when a request cannot be processed successfully.

- `error` (string, required) — Human-readable description of the error that occurred, corresponding to the HTTP status code.

### ZodErrorErrors

Structured dictionary of issues containing two main sections: - `errors`: Array of global validation errors not tied to specific fields - `properties`: Object mapping field names to their specific validation errors, where each field contains an `errors` array

## Examples

### Hosted Silent Authentication

**Response**

```json
{
  "format": "hosted",
  "browserUrl": "https://verify.pinnacle.sh/silent-auth/nar_1234567890ABCDEF?sessionToken=...",
  "expiresAt": "2026-06-12T18:30:00Z",
  "requestId": "nar_1234567890ABCDEF"
}
```

**SDK Code**

```python Hosted Silent Authentication
import requests

url = "https://api.pinnacle.sh/network/silent-auth"

headers = {"PINNACLE-API-KEY": "<apiKey>"}

response = requests.post(url, headers=headers)

print(response.json())
```

```javascript Hosted Silent Authentication
const url = 'https://api.pinnacle.sh/network/silent-auth';
const options = {method: 'POST', headers: {'PINNACLE-API-KEY': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Hosted Silent Authentication
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.pinnacle.sh/network/silent-auth"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("PINNACLE-API-KEY", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Hosted Silent Authentication
require 'uri'
require 'net/http'

url = URI("https://api.pinnacle.sh/network/silent-auth")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["PINNACLE-API-KEY"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java Hosted Silent Authentication
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.pinnacle.sh/network/silent-auth")
  .header("PINNACLE-API-KEY", "<apiKey>")
  .asString();
```

```php Hosted Silent Authentication
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.pinnacle.sh/network/silent-auth', [
  'headers' => [
    'PINNACLE-API-KEY' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp Hosted Silent Authentication
using RestSharp;

var client = new RestClient("https://api.pinnacle.sh/network/silent-auth");
var request = new RestRequest(Method.POST);
request.AddHeader("PINNACLE-API-KEY", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift Hosted Silent Authentication
import Foundation

let headers = ["PINNACLE-API-KEY": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.pinnacle.sh/network/silent-auth")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### JSON Silent Authentication

**Response**

```json
{
  "format": "json",
  "expiresAt": "2026-06-12T18:30:00Z",
  "jsonUrl": "https://api.pinnacle.sh/public/network/silent-auth/nar_1234567890ABCDEF?sessionToken=...&format=json",
  "requestId": "nar_1234567890ABCDEF"
}
```

**SDK Code**

```python JSON Silent Authentication
import requests

url = "https://api.pinnacle.sh/network/silent-auth"

headers = {"PINNACLE-API-KEY": "<apiKey>"}

response = requests.post(url, headers=headers)

print(response.json())
```

```javascript JSON Silent Authentication
const url = 'https://api.pinnacle.sh/network/silent-auth';
const options = {method: 'POST', headers: {'PINNACLE-API-KEY': '<apiKey>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go JSON Silent Authentication
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.pinnacle.sh/network/silent-auth"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("PINNACLE-API-KEY", "<apiKey>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby JSON Silent Authentication
require 'uri'
require 'net/http'

url = URI("https://api.pinnacle.sh/network/silent-auth")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["PINNACLE-API-KEY"] = '<apiKey>'

response = http.request(request)
puts response.read_body
```

```java JSON Silent Authentication
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.pinnacle.sh/network/silent-auth")
  .header("PINNACLE-API-KEY", "<apiKey>")
  .asString();
```

```php JSON Silent Authentication
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.pinnacle.sh/network/silent-auth', [
  'headers' => [
    'PINNACLE-API-KEY' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp JSON Silent Authentication
using RestSharp;

var client = new RestClient("https://api.pinnacle.sh/network/silent-auth");
var request = new RestRequest(Method.POST);
request.AddHeader("PINNACLE-API-KEY", "<apiKey>");
IRestResponse response = client.Execute(request);
```

```swift JSON Silent Authentication
import Foundation

let headers = ["PINNACLE-API-KEY": "<apiKey>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.pinnacle.sh/network/silent-auth")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Hosted Silent Auth

**Request**

```json
{
  "phoneNumber": "+14155550123",
  "clientRef": "user_123"
}
```

**Response**

```json
{
  "format": "hosted",
  "browserUrl": "https://verify.pinnacle.sh/silent-auth/nar_1234567890ABCDEF?sessionToken=...",
  "expiresAt": "2026-06-12T18:30:00Z",
  "requestId": "nar_1234567890ABCDEF"
}
```

**SDK Code**

```python Hosted Silent Auth
import requests

url = "https://api.pinnacle.sh/network/silent-auth"

payload = {
    "phoneNumber": "+14155550123",
    "clientRef": "user_123"
}
headers = {
    "PINNACLE-API-KEY": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript Hosted Silent Auth
const url = 'https://api.pinnacle.sh/network/silent-auth';
const options = {
  method: 'POST',
  headers: {'PINNACLE-API-KEY': '<apiKey>', 'Content-Type': 'application/json'},
  body: '{"phoneNumber":"+14155550123","clientRef":"user_123"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Hosted Silent Auth
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.pinnacle.sh/network/silent-auth"

	payload := strings.NewReader("{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("PINNACLE-API-KEY", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Hosted Silent Auth
require 'uri'
require 'net/http'

url = URI("https://api.pinnacle.sh/network/silent-auth")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["PINNACLE-API-KEY"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\"\n}"

response = http.request(request)
puts response.read_body
```

```java Hosted Silent Auth
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.pinnacle.sh/network/silent-auth")
  .header("PINNACLE-API-KEY", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\"\n}")
  .asString();
```

```php Hosted Silent Auth
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.pinnacle.sh/network/silent-auth', [
  'body' => '{
  "phoneNumber": "+14155550123",
  "clientRef": "user_123"
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'PINNACLE-API-KEY' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp Hosted Silent Auth
using RestSharp;

var client = new RestClient("https://api.pinnacle.sh/network/silent-auth");
var request = new RestRequest(Method.POST);
request.AddHeader("PINNACLE-API-KEY", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Hosted Silent Auth
import Foundation

let headers = [
  "PINNACLE-API-KEY": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  "phoneNumber": "+14155550123",
  "clientRef": "user_123"
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.pinnacle.sh/network/silent-auth")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### JSON Silent Auth

**Request**

```json
{
  "phoneNumber": "+14155550123",
  "clientRef": "user_123",
  "format": "json"
}
```

**Response**

```json
{
  "format": "hosted",
  "browserUrl": "https://verify.pinnacle.sh/silent-auth/nar_1234567890ABCDEF?sessionToken=...",
  "expiresAt": "2026-06-12T18:30:00Z",
  "requestId": "nar_1234567890ABCDEF"
}
```

**SDK Code**

```python JSON Silent Auth
import requests

url = "https://api.pinnacle.sh/network/silent-auth"

payload = {
    "phoneNumber": "+14155550123",
    "clientRef": "user_123",
    "format": "json"
}
headers = {
    "PINNACLE-API-KEY": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript JSON Silent Auth
const url = 'https://api.pinnacle.sh/network/silent-auth';
const options = {
  method: 'POST',
  headers: {'PINNACLE-API-KEY': '<apiKey>', 'Content-Type': 'application/json'},
  body: '{"phoneNumber":"+14155550123","clientRef":"user_123","format":"json"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go JSON Silent Auth
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.pinnacle.sh/network/silent-auth"

	payload := strings.NewReader("{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\",\n  \"format\": \"json\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("PINNACLE-API-KEY", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby JSON Silent Auth
require 'uri'
require 'net/http'

url = URI("https://api.pinnacle.sh/network/silent-auth")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["PINNACLE-API-KEY"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\",\n  \"format\": \"json\"\n}"

response = http.request(request)
puts response.read_body
```

```java JSON Silent Auth
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.pinnacle.sh/network/silent-auth")
  .header("PINNACLE-API-KEY", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\",\n  \"format\": \"json\"\n}")
  .asString();
```

```php JSON Silent Auth
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.pinnacle.sh/network/silent-auth', [
  'body' => '{
  "phoneNumber": "+14155550123",
  "clientRef": "user_123",
  "format": "json"
}',
  'headers' => [
    'Content-Type' => 'application/json',
    'PINNACLE-API-KEY' => '<apiKey>',
  ],
]);

echo $response->getBody();
```

```csharp JSON Silent Auth
using RestSharp;

var client = new RestClient("https://api.pinnacle.sh/network/silent-auth");
var request = new RestRequest(Method.POST);
request.AddHeader("PINNACLE-API-KEY", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"phoneNumber\": \"+14155550123\",\n  \"clientRef\": \"user_123\",\n  \"format\": \"json\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift JSON Silent Auth
import Foundation

let headers = [
  "PINNACLE-API-KEY": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  "phoneNumber": "+14155550123",
  "clientRef": "user_123",
  "format": "json"
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.pinnacle.sh/network/silent-auth")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```