Start a passkey sign-in
Start a passkey sign-in
/api/v1/auth/passkeys/login/optionsReturns the options to pass to navigator.credentials.get(), together
with a single-use ceremony token to return with the assertion.
The ceremony is discoverable: it names no account and lists no allowed credentials, because the authenticator is what proposes an account. That is what makes passkey sign-in usernameless, and it is also why this unauthenticated endpoint cannot be used to ask whether a given credential or account exists — the response is the same for every caller.
Passkey operations are served only by a deployment with a configured
relying party. Where none is configured they return 404, like any
other unrouted path.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string·min 1·max 128The single-use handle for this ceremony. It is a credential — do not log it or place it in a URL.
string <date-time>When the ceremony stops being completable. Roughly five minutes out; after it passes, start a new one.
objectThe WebAuthn options structure, passed to the browser unchanged.
It is deliberately untyped here: it is defined by the WebAuthn
specification rather than by this API, and restating it would create
a second copy to keep in step. Give it to
navigator.credentials.create() or .get() after the usual
base64url decoding a WebAuthn client library performs.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.