Skip to content

Complete passkey login

POST
/auth/webauthn/authentication/verify
curl --request POST \
--url https://example.com/api/v1/auth/webauthn/authentication/verify \
--header 'Content-Type: application/json' \
--data '{ "response": {} }'

Consume the challenge, verify the assertion, guard against counter regression, then mint a session cookie (same contract as password login). Public but only under AUTH=on. On success the session cookie is set via Set-Cookie and the client navigates.

Media typeapplication/json
object
response
required

AuthenticationResponseJSON returned by the browser startAuthentication().

object
key
additional properties
any
Examplegenerated
{
"response": {}
}

Authenticated; session cookie set

Media typeapplication/json
object
verified
required
boolean
Examplegenerated
{
"verified": true
}

Missing/expired challenge, unknown credential, or verification failed

Media typeapplication/json
object
error
required

Error message

string
Examplegenerated
{
"error": "example"
}

Passkeys require AUTH=on

Media typeapplication/json
object
error
required

Error message

string
Examplegenerated
{
"error": "example"
}

WebAuthn RP resolution failed

Media typeapplication/json
object
error
required

Error message

string
Examplegenerated
{
"error": "example"
}