Verify passkey authentication and start session

This endpoint documentation is generated directly from openapi.yaml.

Endpoint

POST /auth/passkey/verify

Operation

Operation ID: passkeyVerify

Verifies the WebAuthn assertion and challenge token. Returns a session token on success.

Authentication

No authentication required.

Request Body

Required: yes.

Content type: application/json

{
  "properties": {
    "challenge_token": {
      "description": "The token returned by the challenge endpoint",
      "type": "string"
    },
    "credential": {
      "description": "The WebAuthn PublicKeyCredential object (assertion)",
      "properties": {
        "clientExtensionResults": {
          "type": "object"
        },
        "id": {
          "description": "The credential ID (base64url)",
          "type": "string"
        },
        "rawId": {
          "description": "The raw credential ID (base64url)",
          "type": "string"
        },
        "response": {
          "properties": {
            "authenticatorData": {
              "description": "Base64URL-encoded authenticator data",
              "type": "string"
            },
            "clientDataJSON": {
              "description": "Base64URL-encoded client data",
              "type": "string"
            },
            "signature": {
              "description": "Base64URL-encoded signature",
              "type": "string"
            },
            "userHandle": {
              "description": "Base64URL-encoded user handle",
              "nullable": true,
              "type": "string"
            }
          },
          "required": [
            "clientDataJSON",
            "authenticatorData",
            "signature"
          ],
          "type": "object"
        },
        "type": {
          "example": "public-key",
          "type": "string"
        }
      },
      "required": [
        "id",
        "rawId",
        "type",
        "response"
      ],
      "type": "object"
    },
    "g_recaptcha_response": {
      "description": "reCAPTCHA verification token",
      "type": "string"
    }
  },
  "required": [
    "challenge_token",
    "credential",
    "g_recaptcha_response"
  ],
  "type": "object"
}
        

Responses

Status	Description	Content Types
200	Verification successful, session started	application/json
400
401

Schema for response 200 (application/json):

{
  "oneOf": [
    {
      "properties": {
        "token": {
          "description": "Bearer token for customer",
          "type": "string"
        }
      },
      "required": [
        "token"
      ],
      "type": "object"
    },
    {
      "properties": {
        "session": {
          "description": "Session token for subuser",
          "type": "string"
        }
      },
      "required": [
        "session"
      ],
      "type": "object"
    }
  ]
}
        

17 March 2026