Signs in with a passkey.
A passkey stands for the password and the second step together, so an account with two-step sign-in on is signed in straight away.
Errors
401 passkey_rejected when the answer cannot sign anybody in, whatever
the reason; 429 when too many have failed from this address.
application/json- body
Body of POST /auth/passkey.
credential*What the browser returned from navigator.credentials.get.
Signed in
application/json- response
An account, as the API describes it. Never carries a hash.
email*stringNormalised address.
email_verified_at?|When the address was last proven to reach this user, or null if never.
Set by confirming a registration, by a provider vouching for the
address, or by following the link from
POST /account/email/verification. Cleared when the address changes.
date-timehas_password*booleanWhether the account has a password.
An account created through GitHub, Discord or OIDC has none. It confirms
changes by having signed in within the last few minutes instead of by
typing one, so a client shows a password field only when this is
true; see reauthentication_required.
id*stringStable identifier.
is_admin*booleanWhether the account holds the seeded administrator role.
Kept because clients read it, but derived and not stored, and narrower
than permissions. An account in a role granting users:read
and nothing else is not an administrator, yet reaches one administrative
endpoint. New clients should read permissions.
must_change_password*booleanWhether the account must set a new password before doing anything else.
Set on the administrator generated at first run. A client seeing this should send the user to a change-password screen and nowhere else.
permissions*array<string>Everything this account is allowed to do.
resource:verb strings, and what a client should decide from. A screen
guessing from is_admin is wrong for every role between "member" and
"everything".
quota_bytes?|A storage quota set on this one account, overriding its role's.
null means the role's applies; 0 means this account has no ceiling
of its own. What is actually left is storage_remaining_bytes on
/capabilities, which accounts for what has been used.
int640 <= valueroles*array<string>The roles it is in, by name.
username*stringNormalised account name.
curl -X POST 'https://example.com/api/v1/auth/passkey' \ -H 'Content-Type: application/json' \ -d '{ "credential": { "id": "string", "response": { "authenticatorData": "string", "clientDataJSON": "string", "signature": "string" } }}'{ "email": "string", "email_verified_at": "2019-08-24T14:15:22Z", "has_password": true, "id": "string", "is_admin": true, "must_change_password": true, "permissions": [ "string" ], "quota_bytes": 0, "roles": [ "string" ], "username": "string"}