Sign in
latestOpenAPI 3.1.02026-08-223914256.0 MB

f1cf47ad0ec2

Users

Create Challenge

Mints the challenge a browser needs to run a WebAuthn ceremony against the authenticated user's own passkeys. A registration challenge enrolls a new passkey; a deletion challenge is bound to the one passkey named by passkey_id and proves the user still holds it. Challenges are single-use and expire 5 minutes after they are issued, so send a fresh Idempotency-Key per ceremony — a replayed key returns the original challenge, which may already have expired. Requires a user session.

post/users/me/passkeys/challenge

Headers

Idempotency-Keystring
Example:d9105228-4a08-46b1-8b91-42fed586d383

A unique key that makes this request safe to retry. See Idempotent requests.

Request body

challenge_type'registration' | 'deletion' required

The ceremony this challenge is for.

passkey_idstring

The passkey the ceremony targets, prefixed wcred_. Required when challenge_type is deletion, ignored otherwise.

Example request

{
  "challenge_type": "registration",
  "passkey_id": "wcred_xxxxxxxxxxxxxx"
}

Response

challenge minted

challengestring required

The challenge to pass to the WebAuthn ceremony, base64url-encoded without padding.

Example response

{
  "challenge": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}