v8

latestOpenAPI 3.1.02026-08-033623795.0 MB

Users

Register

Registers a passkey for the authenticated user from the attestation a browser produced for a registration challenge. Mint that challenge first with POST /users/me/passkeys/challenge; it is single-use and expires 5 minutes after it is issued. Requires a user session.

post/users/me/passkeys

Headers

Idempotency-Keystring

Example:d9105228-4a08-46b1-8b91-42fed586d383

A unique key that makes this request safe to retry. See Idempotent requests.

Request body

attestation_objectstring required

The attestationObject from the WebAuthn attestation response, base64url-encoded.

client_data_jsonstring required

The clientDataJSON from the WebAuthn attestation response, base64url-encoded.

credential_idstring required

The WebAuthn credential ID the authenticator returned, base64url-encoded.

nicknamestring required

A name for this passkey, usually the device it lives on. 255 characters or fewer.

Response

passkey registered

created_atstring required

When the user registered this passkey, as an ISO 8601 timestamp.

credential_idstring required

The WebAuthn credential ID as a base64url string. Pass it in allowCredentials when you run a ceremony against this specific passkey.

idstring required

Passkey ID, prefixed wcred_. Use it to delete the passkey.

last_used_atstring nullable required

When this passkey last completed a WebAuthn ceremony, as an ISO 8601 timestamp, or null if it never has.

nicknamestring required

The name the user gave this passkey, usually the device it lives on.