Sign in
OpenAPI 3.1.02026-08-163864115.7 MB

c363cb2feb95

Users

Register

Registers a passkey for the authenticated user from the attestation a browser produced for a registration challenge. Mint that challenge first with POST /users/me/passkeys/challenge; it is single-use and expires 5 minutes after it is issued. Requires a user session.

post/users/me/passkeys

Headers

Idempotency-Keystring
Example:d9105228-4a08-46b1-8b91-42fed586d383

A unique key that makes this request safe to retry. See Idempotent requests.

Request body

attestation_objectstring required

The attestationObject from the WebAuthn attestation response, base64url-encoded.

client_data_jsonstring required

The clientDataJSON from the WebAuthn attestation response, base64url-encoded.

credential_idstring required

The WebAuthn credential ID the authenticator returned, base64url-encoded.

nicknamestring required

A name for this passkey, usually the device it lives on. 255 characters or fewer.

Example request

{
  "attestation_object": "YXR0ZXN0YXRpb24",
  "client_data_json": "Y2xpZW50LWRhdGE",
  "credential_id": "bmV3LWNyZWRlbnRpYWw",
  "nickname": "Work laptop"
}

Response

passkey registered

created_atstring required

When the user registered this passkey, as an ISO 8601 timestamp.

credential_idstring required

The WebAuthn credential ID as a base64url string. Pass it in allowCredentials when you run a ceremony against this specific passkey.

idstring required

Passkey ID, prefixed wcred_. Use it to delete the passkey.

last_used_atstring nullable required

When this passkey last completed a WebAuthn ceremony, as an ISO 8601 timestamp, or null if it never has.

nicknamestring required

The name the user gave this passkey, usually the device it lives on.

Example response

{
  "created_at": "2026-01-01T12:00:00.000Z",
  "credential_id": "bGFwdG9wLWNyZWRlbnRpYWw",
  "id": "wcred_xxxxxxxxxxxxxx",
  "last_used_at": "2026-01-01T12:00:00.000Z",
  "nickname": "MacBook Pro"
}