Sign in with a passkey

POST /v1/auth/passkeys/login

Send the passkey's response. Starts a session verified with a second factor, like POST /v1/auth/login/mfa.

Body

application/json

ceremony_tokenstringrequired

From POST /v1/auth/passkeys/login/options

maxLength: 256

credentialobjectrequired

The PublicKeyCredential from navigator.credentials.get(), as JSON

transportstring

cookie (browsers): an HttpOnly session cookie; bearer (native apps): the token in the response

one of: cookie, bearerdefault: "cookie"

Responses

errors: application/problem+json

200

401

Unauthorized

422

Unprocessable Entity

500

Internal Server Error

503

Service Unavailable

Match errors on the problem's code, which stays the same, not on its message.

Send a request

Server

Body

The request goes from your browser straight to this server; nothing passes through this site. The API must allow this site's origin for CORS.

Requestexample

curl -X POST "$API_URL/v1/auth/passkeys/login" \
  -H "Content-Type: application/json" \
  -d '{
  "ceremony_token": "string",
  "credential": {},
  "transport": "cookie"
}'

body := strings.NewReader(`{
  "ceremony_token": "string",
  "credential": {},
  "transport": "cookie"
}`)
req, err := http.NewRequestWithContext(ctx, http.MethodPost,
	apiURL + "/v1/auth/passkeys/login", body)
if err != nil {
	return err
}
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer res.Body.Close()

const res = await fetch(`${apiUrl}/v1/auth/passkeys/login`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "ceremony_token": "string",
    "credential": {},
    "transport": "cookie"
  }),
});
const data = await res.json();

Responseexample

{
  "mfa": {
    "challenge_token": "string",
    "expires_at": "2026-09-15T12:00:00Z",
    "methods": [
      "string"
    ]
  },
  "session": {
    "created_at": "2026-09-15T12:00:00Z",
    "current": false,
    "expires_at": "2026-09-15T12:00:00Z",
    "id": "ses_nbswy3dpeb3w64tmmq",
    "last_seen_at": "2026-09-15T12:00:00Z",
    "mfa_verified": false,
    "ip": "string",
    "user_agent": "string"
  },
  "token": "string",
  "user": {
    "created_at": "2026-09-15T12:00:00Z",
    "email": "ada@example.com",
    "email_verified": false,
    "has_password": false,
    "id": "usr_mfrggzdfmztwq2lk",
    "roles": [
      "string"
    ]
  }
}

{
  "code": "string",
  "status": 401,
  "title": "Unauthorized",
  "detail": "string",
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}

{
  "code": "string",
  "status": 422,
  "title": "Unprocessable Entity",
  "detail": "string",
  "errors": [
    {
      "message": "expected length >= 1",
      "location": "body.name"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}