---
title: "Initialize WebAuthn login"
method: POST
path: "/webauthn/login/initialize"
tags: ["WebAuthn"]
deprecated: true
---

# Initialize WebAuthn login

`POST /webauthn/login/initialize`

> **Deprecated.**

Initialize a login with Webauthn. Returns a JSON representation of CredentialRequestOptions for use
with the Webauthn API's `navigator.credentials.get()`.

Omitting the optional request body or using an empty JSON object results in generation of request options for a
login using a [discoverable credential](https://www.w3.org/TR/webauthn-2/#client-side-discoverable-public-key-credential-source)
(i.e. they will not contain
[allowCredentials](https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialrequestoptions-allowcredentials)).

*Note*: The Webauthn API uses binary data represented by ArrayBuffers for certain input/output values.
The Hanko API returns these values as base64url-encoded, so they must be converted to ArrayBuffers
when passed to the Webauthn API. Similarly, Webauthn API output must be converted to base64url-encoded values
when passed to the Hanko API (e.g. using the [webauthn-json](https://github.com/github/webauthn-json) library).

## Request body

- object
  - `user_id` string, uuid4

## Response `200`

Successful initialization

- CredentialRequestOptions — Options for assertion generation with the WebAuthn API
  - `publicKey` object
    - `challenge` string, base64url
    - `timeout` integer
    - `rpId` string
    - `allowCredentials` object[]
      - `type` 'public-key'
      - `id` string, base64url
    - `userVerification` 'required' | 'preferred' | 'discouraged'

## Other responses

- `400` — Bad Request
- `500` — Internal server error

---

[API](https://skmtc.net/hanko/apis/hanko-admin-api.md) · [All operations](https://skmtc.net/hanko/apis/hanko-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/hanko/hanko-admin-api/versions/d22a127b0978/schema)