Starts a sign-in with a passkey.

POST

/api/v1/auth/passkey/options

Nobody is named: the browser offers whichever passkeys it holds for this site, and the answer says whose account it is.

Errors

404 when this instance has no accounts, 503 when it cannot tell what address it is on.

Response Body

Options for navigator.credentials.get

application/json

response

PublicKeyCredentialRequestOptionsJSON.

allowCredentials*array<>

Always empty: the browser offers whichever passkeys it holds for the site, and the answer says which account.

challenge*string

Base64url; answered once, within timeout.

rpId*string

The host name the passkey must be scoped to.

timeout*integer

Milliseconds.

Formatint64

Range0 <= value

userVerification*string

Always required.

curl -X POST 'https://example.com/api/v1/auth/passkey/options'

{  "allowCredentials": [    {      "id": "string",      "type": "string"    }  ],  "challenge": "string",  "rpId": "string",  "timeout": 0,  "userVerification": "string"}