Finish registering a passkey
Finish registering a passkey
/api/v1/auth/passkeys/register/verifyVerifies the authenticator's attestation and stores the credential under the supplied name.
The account is taken from the session, never from the request: a body-supplied user would let a caller enrol a credential onto someone else's account. A ceremony started by a different account is refused.
Registering a passkey does not remove any other sign-in method. It also does not require the account to have one — but the account's last remaining method cannot later be deleted.
Header Parameters
Request Body
application/jsonstring·min 1·max 64The user's own label for the device, shown in their passkey list. Surrounding whitespace is trimmed; control characters are rejected.
Responses
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
string <uuid>Opaque Assign-owned UUIDv7 identifier. Clients must not derive meaning from it.
string·min 1·max 64The user's own label for the device, shown in their passkey list. Surrounding whitespace is trimmed; control characters are rejected.
booleanWhether the authenticator reported the credential as syncable. This
never changes for a credential. Together with backup_state it is
what tells a user whether losing the device means losing the
passkey.
booleantrue when the credential was disabled because its signature
counter failed to advance, which indicates a second copy of the
private key. It cannot be used to sign in and cannot be
re-enabled — remove it and register a new one.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.
integer·min 1Seconds until the client may retry.
integer·min 0Delay in seconds before retrying, when an expected maintenance end is known.
string·const no-storePrevents storage of error responses by clients and intermediaries.
string·min 1·max 200Correlation identifier for the request.
string·const nosniffPrevents user agents from MIME-sniffing the response.