Initiate passkey authentication challenge

This endpoint documentation is generated directly from openapi.yaml.

Endpoint

POST /auth/passkey/challenge

Operation

Operation ID: passkeyChallenge

Generates a WebAuthn PublicKeyCredentialRequestOptions payload. If customer_number is provided, allowCredentials will be populated with existing passkeys for that account. Otherwise, a challenge is issued for discoverable credentials.

Authentication

No authentication required.

Request Body

Required: yes.

Content type: application/json

{
  "properties": {
    "customer_number": {
      "description": "Optional customer's e-conomic customer number",
      "example": 12345,
      "type": "integer"
    },
    "g_recaptcha_response": {
      "description": "reCAPTCHA verification token",
      "type": "string"
    }
  },
  "required": [
    "g_recaptcha_response"
  ],
  "type": "object"
}
        

Responses

Status	Description	Content Types
200	Challenge generated	application/json
400

Schema for response 200 (application/json):

{
  "properties": {
    "challenge_token": {
      "description": "Temporary token binding the challenge to the login attempt",
      "type": "string"
    },
    "publicKey": {
      "properties": {
        "allowCredentials": {
          "items": {
            "properties": {
              "id": {
                "description": "Base64URL-encoded credential ID",
                "type": "string"
              },
              "transports": {
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "type": {
                "example": "public-key",
                "type": "string"
              }
            },
            "type": "object"
          },
          "type": "array"
        },
        "challenge": {
          "description": "Base64URL-encoded challenge",
          "type": "string"
        },
        "rpId": {
          "description": "Relying party ID (truckwash.io or localhost)",
          "example": "truckwash.io",
          "type": "string"
        },
        "timeout": {
          "description": "Timeout in milliseconds",
          "type": "integer"
        },
        "userVerification": {
          "enum": [
            "required",
            "preferred",
            "discouraged"
          ],
          "type": "string"
        }
      },
      "type": "object"
    }
  },
  "type": "object"
}
        

17 March 2026