Complete passkey registration

POST

/auth/webauthn/registration/verify

curl --request POST \
  --url https://example.com/api/v1/auth/webauthn/registration/verify \
  --header 'Content-Type: application/json' \
  --data '{ "response": {}, "name": "example" }'

• API v1

Consume the single-use challenge, verify the attestation, and persist the credential for the authenticated local user. Requires AUTH=on and a real local user.

Request Body^required

Media typeapplication/json

object

response

required

RegistrationResponseJSON returned by the browser startRegistration().

object

key

additional properties

any

name

Optional friendly credential name. Defaults to a user-agent-derived name when omitted.

string

<= 100 characters

Example^generated

{
  "response": {},
  "name": "example"
}

Responses

200

Credential registered

Media typeapplication/json

object

verified

required

boolean

credential

required

Client-safe view of a registered passkey (no key material).

object

id

required

Base64URLString credential id.

string

name

required

string

createdAt

required

string

lastUsedAt

string

nullable

deviceType

required

string

Allowed values: singleDevice multiDevice

backedUp

required

boolean

Example

{
  "credential": {
    "deviceType": "singleDevice"
  }
}

400

Missing/expired challenge or verification failed

Media typeapplication/json

object

error

required

Error message

string

Example^generated

{
  "error": "example"
}

401

Not an authenticated local user

Media typeapplication/json

object

error

required

Error message

string

Example^generated

{
  "error": "example"
}

409

Duplicate name / passkey already registered / AUTH not on

Media typeapplication/json

object

error

required

Error message

string

Example^generated

{
  "error": "example"
}

500

WebAuthn RP resolution failed

Media typeapplication/json

object

error

required

Error message

string

Example^generated

{
  "error": "example"
}