API reference/Auth

Start a passkey second factor

POST/v1/auth/login/mfa/passkey

After a 202 from `POST /v1/auth/login` listing `passkey`: returns options limited to the account's passkeys. Send the response to `POST /v1/auth/login/mfa`.

no auth

Request body application/json · required

challenge_tokenstringrequired

From the 202 response of POST /v1/auth/login

max length 256

Responses

200OKapplication/json

ceremony_tokenstringrequired

Send it back with the passkey's response. It is shown once and expires after 5 minutes.

expires_atstring (date-time)required

optionsanyrequired

Pass to navigator.credentials.create() or navigator.credentials.get() (PublicKeyCredential.parseCreationOptionsFromJSON or parseRequestOptionsFromJSON reads them)

401Unauthorizedapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

422Unprocessable Entityapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

500Internal Server Errorapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

503Service Unavailableapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

Was this page useful?

v0.5

Request

curl -X POST "https://api.example.com/v1/auth/login/mfa/passkey" \
  -H "Content-Type: application/json" \
  -d '{
  "challenge_token": "string"
}'

req, _ := http.NewRequest("POST", "https://api.example.com/v1/auth/login/mfa/passkey", strings.NewReader(`{
  "challenge_token": "string"
}`))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer resp.Body.Close()

const res = await fetch("https://api.example.com/v1/auth/login/mfa/passkey", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "challenge_token": "string"
  }),
});
const data = await res.json();

Response

{
  "ceremony_token": "string",
  "expires_at": "2026-09-15T12:00:00Z",
  "options": null
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

Base URL: https://api.example.com
Auth: none