Optionalauth_The auth session token. Present when the session is still alive and the caller may retry the token exchange with corrected OTP codes. Absent when the session is terminal (exhausted, expired, or unknown).
OptionalmessageOptionalverification_Identifiers that still require a valid OTP code. Present on retryable
invalid_grant (wrong code) responses. Absent on terminal failures.
Passkey token exchange error response.
In addition to the common fields, a wrong verification code response carries
verification_requiredandauth_session.