diff --git a/openapi.yaml b/openapi.yaml
index c92578f3..206578d5 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -1131,6 +1131,138 @@ paths:
         '401':
           $ref: '#/components/responses/Unauthorized'
 
+  /auth/passkey/challenge:
+    post:
+      tags:
+        - Authentication
+      summary: Initiate passkey authentication challenge
+      description: Generates a WebAuthn PublicKeyCredentialRequestOptions payload. If customer_number is provided, allowCredentials will be populated with existing passkeys for that account. Otherwise, a challenge is issued for discoverable credentials.
+      operationId: passkeyChallenge
+      security: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                customer_number:
+                  type: integer
+                  description: Optional customer's e-conomic customer number
+                  example: 12345
+      responses:
+        '200':
+          description: Challenge generated
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  challenge_token:
+                    type: string
+                    description: Temporary token binding the challenge to the login attempt
+                  publicKey:
+                    type: object
+                    properties:
+                      challenge:
+                        type: string
+                        description: Base64URL-encoded challenge
+                      rpId:
+                        type: string
+                        description: Relying party ID (domain)
+                      timeout:
+                        type: integer
+                        description: Timeout in milliseconds
+                      userVerification:
+                        type: string
+                        enum: [required, preferred, discouraged]
+                      allowCredentials:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            type:
+                              type: string
+                              example: public-key
+                            id:
+                              type: string
+                              description: Base64URL-encoded credential ID
+                            transports:
+                              type: array
+                              items:
+                                type: string
+        '400':
+          $ref: '#/components/responses/BadRequest'
+
+  /auth/passkey/verify:
+    post:
+      tags:
+        - Authentication
+      summary: Verify passkey authentication and start session
+      description: Verifies the WebAuthn assertion and challenge token. Returns a session token on success.
+      operationId: passkeyVerify
+      security: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - challenge_token
+                - id
+                - response
+              properties:
+                challenge_token:
+                  type: string
+                  description: The token returned by the challenge endpoint
+                id:
+                  type: string
+                  description: The credential ID (base64url)
+                response:
+                  type: object
+                  required:
+                    - clientDataJSON
+                    - authenticatorData
+                    - signature
+                  properties:
+                    clientDataJSON:
+                      type: string
+                      description: Base64URL-encoded client data
+                    authenticatorData:
+                      type: string
+                      description: Base64URL-encoded authenticator data
+                    signature:
+                      type: string
+                      description: Base64URL-encoded signature
+                    userHandle:
+                      type: string
+                      nullable: true
+                      description: Base64URL-encoded user handle
+      responses:
+        '200':
+          description: Verification successful, session started
+          content:
+            application/json:
+              schema:
+                oneOf:
+                  - type: object
+                    required: [token]
+                    properties:
+                      token:
+                        type: string
+                        description: Bearer token for customer
+                  - type: object
+                    required: [session]
+                    properties:
+                      session:
+                        type: string
+                        description: Session token for subuser
+        '400':
+          $ref: '#/components/responses/BadRequest'
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+
   /auth/logout:
     get:
       tags:
diff --git a/src/views/dashboards/userDashboard/profile/displays/Passkeys/PasskeyManagement.vue b/src/views/dashboards/userDashboard/profile/displays/Passkeys/PasskeyManagement.vue
index 9fa55028..ec8cbd6c 100644
--- a/src/views/dashboards/userDashboard/profile/displays/Passkeys/PasskeyManagement.vue
+++ b/src/views/dashboards/userDashboard/profile/displays/Passkeys/PasskeyManagement.vue
@@ -24,7 +24,7 @@ const loadPasskeys = async () => {
   isLoading.value = true;
   try {
     const response = await SessionUser.request('/account/security/passkeys', 'GET');
-    passkeys.value = response.data || [];
+    passkeys.value = response.data.data || [];
   } catch (error) {
     console.error('Failed to load passkeys:', error);
   } finally {