Add a passkey

POST /v1/auth/passkeys

Send the browser's response to the registration options. Verifies this session with a second factor; the account's first second factor also returns recovery codes.

Authorization

bearer

Authorizationheader · stringrequired

Session token from POST /v1/auth/login with "transport": "bearer". Browsers use the session cookie that login sets instead.

Body

application/json

ceremony_tokenstringrequired

maxLength: 256

credentialobjectrequired

The PublicKeyCredential from navigator.credentials.create(), as JSON (PublicKeyCredential.toJSON())

namestring

A label to recognise it by; default Passkey

maxLength: 100

Responses

errors: application/problem+json

201

Created

401

Unauthorized

409

Conflict

422

Unprocessable Entity

500

Internal Server Error

503

Service Unavailable

Match errors on the problem's code, which stays the same, not on its message.

Send a request

Server

Bearer token

Body

The request goes from your browser straight to this server; nothing passes through this site. The API must allow this site's origin for CORS.

Requestexample

curl -X POST "$API_URL/v1/auth/passkeys" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "ceremony_token": "string",
  "credential": {},
  "name": "MacBook"
}'

body := strings.NewReader(`{
  "ceremony_token": "string",
  "credential": {},
  "name": "MacBook"
}`)
req, err := http.NewRequestWithContext(ctx, http.MethodPost,
	apiURL + "/v1/auth/passkeys", body)
if err != nil {
	return err
}
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer res.Body.Close()

const res = await fetch(`${apiUrl}/v1/auth/passkeys`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "ceremony_token": "string",
    "credential": {},
    "name": "MacBook"
  }),
});
const data = await res.json();

Responseexample

{
  "passkey": {
    "backed_up": false,
    "created_at": "2026-09-15T12:00:00Z",
    "id": "pky_nbswy3dpeb3w64tmmq",
    "name": "MacBook",
    "last_used_at": "2026-09-15T12:00:00Z"
  },
  "recovery_codes": [
    "string"
  ]
}

{
  "code": "string",
  "status": 401,
  "title": "Unauthorized",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 409,
  "title": "Conflict",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 422,
  "title": "Unprocessable Entity",
  "detail": "string",
  "errors": [
    {
      "message": "expected length >= 1",
      "location": "body.name"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}