Lists the caller's passkeys, oldest first.

GET

/api/v1/account/passkeys

401 when nothing was signed in, 403 when a bearer token was used.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

The caller's passkeys

application/json

[index: integer]?

A passkey, as its owner sees it.

curl -X GET 'https://example.com/api/v1/account/passkeys'

[  {    "backed_up": true,    "created_at": "string",    "id": "string",    "last_used_at": "string",    "name": "string"  }]

Turns the second step on, by showing a code from the app just set up. POST

Adds the passkey the browser just made. POST