Complete a passkey sign-in
Complete a passkey sign-in
/api/v1/auth/passkeys/login/verifyVerifies the authenticator's assertion and issues a browser session.
No second factor is requested. A passkey is strong authentication on its own — the authenticator performed user verification, which is the assurance a second factor exists to add — so unlike a password sign-in this never returns a challenge. A successful response is always the account.
Every failure is 401, whether the ceremony was unknown, expired, or
already used, or the assertion did not verify. The distinctions are
useful only to someone probing the endpoint; an honest client can only
start a new ceremony.
A credential whose signature counter fails to advance is treated as
cloned: it is disabled, and this and every later attempt with it are
refused. The account's other sign-in methods continue to work, and the
credential remains listed — marked disabled — so the user can see
what happened.
Request Body
application/jsonobjectThe PublicKeyCredential returned by
navigator.credentials.get(), serialized as JSON in the form a
WebAuthn client library produces.
booleanWhether to remember this device. true (the default when omitted,
which preserves earlier client behavior) issues a persistent
session cookie with the 7-day idle and 30-day absolute lifetimes.
false issues a browser-session cookie that the browser discards
when it closes, and the server bounds the session to 48 hours,
idle and absolute.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string <email>·min 3·max 320Normalized to lowercase and trimmed before storage and comparison.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.