Start passkey enrollment
curl --request POST \
--url https://my.server.express/api/v1/user/passkeys/options \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://my.server.express/api/v1/user/passkeys/options', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/user/passkeys/options"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"success": true,
"data": {
"challenge": "<string>",
"rp": {},
"user": {},
"pubKeyCredParams": [
{}
],
"excludeCredentials": [
{}
]
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Passkeys
Start passkey enrollment
Mints WebAuthn registration options for startRegistration() (attestation none, resident key and user verification
preferred). Already-enrolled credentials are excluded. Stores the challenge for 5 minutes; starting again replaces it.
No request body.
POST
/
v1
/
user
/
passkeys
/
options
Start passkey enrollment
curl --request POST \
--url https://my.server.express/api/v1/user/passkeys/options \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://my.server.express/api/v1/user/passkeys/options', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://my.server.express/api/v1/user/passkeys/options"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"success": true,
"data": {
"challenge": "<string>",
"rp": {},
"user": {},
"pubKeyCredParams": [
{}
],
"excludeCredentials": [
{}
]
}
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}{
"success": false,
"error": "<string>"
}Authorizations
Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope.