---
title: "Verify passkey sign-in WebAuthn authentication"
method: POST
path: "/api/experience/verification/sign-in-passkey/authentication/verify"
tags: ["Experience"]
---

# Verify passkey sign-in WebAuthn authentication

`POST /api/experience/verification/sign-in-passkey/authentication/verify`

Verify the passkey sign-in WebAuthn authentication response against the stored authentication challenge. When `verificationId` is provided, it verifies against the challenge generated by the identifier-based authentication endpoint. When omitted, it verifies against the preflight authentication options stored in the interaction. Upon successful verification, the verification record will be marked as verified and the user will be resolved by the credential if not provided earlier.

## Request body

- object
  - `verificationId` string — The verification ID of the passkey sign-in WebAuthn authentication record. Optional when using discoverable passkey flow with preflight authentication options.
  - `payload` object, required — The WebAuthn assertion response from the user's passkey credential.
    - `type` string, "WebAuthn", required
    - `id` string, required
    - `rawId` string, required
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `clientExtensionResults` object, required
      - `appid` boolean
      - `crepProps` object
        - `rk` boolean
      - `hmacCreateSecret` boolean
    - `response` object, required
      - `clientDataJSON` string, required
      - `authenticatorData` string, required
      - `signature` string, required
      - `userHandle` string

## Response `200`

The passkey sign-in WebAuthn authentication has been successfully verified.

- object
  - `verificationId` string, required — The unique verification ID of the passkey sign-in WebAuthn authentication verification record.

## Other responses

- `400` — Invalid request. <br/> - `session.mfa.pending_info_not_found:` The WebAuthn authentication challenge is missing in the current verification record. <br/>- `session.mfa.webauthn_verification_failed:` The WebAuthn assertion response is invalid or cannot be verified.
- `404` — Verification session not found.
- `409` — Identity conflict. <br/> - `session.identity_conflict:` The user associated with the verified WebAuthn credential does not match the identified user in the current interaction.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/revisions/a163dc77d842/schema)