# Share Authentication

Share Authentication handles identity verification for **external recipients** —
people outside the organization who have received a share link but do not have
a platform account.

The platform uses a one-time passcode (OTP) flow for external share access:
1. The recipient visits a share link and enters their email address
2. `generate-otp` sends a time-limited OTP to that address
3. The recipient submits the OTP via `exchange-otp`, which returns a short-lived
   access token scoped to the specific share

This token is then used to call the [Shared Content](#tag/Shared-Content) endpoints.
It grants access only to what was explicitly included in the share — no other
platform data is accessible.


## Generate share access code

 - [POST /api/v1/share-auth/generate-otp](https://api.tenovos.com/openapi/content-intelligence/share-authentication/tenovos.sharing.shareauthservice.generateotp.md): Generates and sends a one-time passcode (OTP) to the recipient of a share, initiating passwordless authentication.

Request:
shareAccessId      - The share access ID identifying which share the OTP is for.
expiresInSeconds   - Lifetime of the generated OTP in seconds.

Response:
(empty) - The OTP is delivered out-of-band (e.g. via email) to the share recipient.

## Exchange code for token

 - [POST /api/v1/share-auth/exchange-otp](https://api.tenovos.com/openapi/content-intelligence/share-authentication/tenovos.sharing.shareauthservice.exchangeotp.md): Exchanges a valid OTP for a short-lived access token that grants access to the share.

Request:
shareAccessId   - The share access ID the OTP was generated for.
otp               - The one-time passcode provided by the share recipient.

Response:
token          - A short-lived bearer token granting access to the associated share.
expiresIn     - Lifetime of the token in seconds.