Starts adding a passkey to the caller's account.

POST

/api/v1/account/passkeys/options

Why it asks for the password

A passkey is a way in. A borrowed, unlocked browser must not be able to add one the borrower holds.

Errors

401 when the password is wrong, 403 when a bearer token was used, 503 when this instance cannot tell what address it is on.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

Request Body

application/json

body

Body of POST /account/passkeys/options.

current_password?|

The current password. Omitted by an account without one, which confirms by a recent sign-in instead.

Length8 <= length <= 1024

Response Body

Options for navigator.credentials.create

application/json

response

PublicKeyCredentialCreationOptionsJSON.

attestation*string

Always none; see auth::webauthn.

authenticatorSelection*

See [AuthenticatorSelection].

challenge*string

Base64url; answered once, within timeout.

excludeCredentials*array<>

The account's existing passkeys, so the same authenticator is not added twice.

pubKeyCredParams*array<>

The algorithms this accepts, preferred first.

rp*

The site.

timeout*integer

Milliseconds.

Formatint64

Range0 <= value

user*

The account.

curl -X POST 'https://example.com/api/v1/account/passkeys/options' \  -H 'Content-Type: application/json' \  -d '{}'

{  "attestation": "string",  "authenticatorSelection": {    "requireResidentKey": true,    "residentKey": "string",    "userVerification": "string"  },  "challenge": "string",  "excludeCredentials": [    {      "id": "string",      "type": "string"    }  ],  "pubKeyCredParams": [    {      "alg": 0,      "type": "string"    }  ],  "rp": {    "id": "string",    "name": "string"  },  "timeout": 0,  "user": {    "displayName": "string",    "id": "string",    "name": "string"  }}