Complete passkey login

POST

/auth/webauthn/authentication/verify

curl --request POST \
  --url https://example.com/api/v1/auth/webauthn/authentication/verify \
  --header 'Content-Type: application/json' \
  --data '{ "response": {} }'

• API v1

Consume the challenge, verify the assertion, guard against counter regression, then mint a session cookie (same contract as password login). Public but only under AUTH=on. On success the session cookie is set via Set-Cookie and the client navigates.

Request Body^required

Media typeapplication/json

object

response

required

AuthenticationResponseJSON returned by the browser startAuthentication().

object

key

additional properties

any

Example^generated

{
  "response": {}
}

Responses

200

Authenticated; session cookie set

Media typeapplication/json

object

verified

required

boolean

Example^generated

{
  "verified": true
}

400

Missing/expired challenge, unknown credential, or verification failed

Media typeapplication/json

object

error

required

Error message

string

code

Stable machine-readable code present on 5xx responses; error is a fixed user-safe message, raw detail is logged server-side only

string

Allowed values: cleanup_failed library_fetch_failed episodes_fetch_failed releases_fetch_failed

Example

{
  "code": "cleanup_failed"
}

409

Passkeys require AUTH=on

Media typeapplication/json

object

error

required

Error message

string

code

Stable machine-readable code present on 5xx responses; error is a fixed user-safe message, raw detail is logged server-side only

string

Allowed values: cleanup_failed library_fetch_failed episodes_fetch_failed releases_fetch_failed

Example

{
  "code": "cleanup_failed"
}

500

WebAuthn RP resolution failed

Media typeapplication/json

object

error

required

Error message

string

code

Stable machine-readable code present on 5xx responses; error is a fixed user-safe message, raw detail is logged server-side only

string

Allowed values: cleanup_failed library_fetch_failed episodes_fetch_failed releases_fetch_failed

Example

{
  "code": "cleanup_failed"
}