Adds the passkey the browser just made.

POST

/api/v1/account/passkeys

Errors

400 when the answer does not check out or its challenge is gone, 403 when a bearer token was used, 409 when that passkey is already registered.

Authorization

session

cookietessera_session<token>

Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.

Request Body

application/json

body

Body of POST /account/passkeys.

credential*

What the browser returned from navigator.credentials.create.

name?|

What to call it. Passkey when omitted.

Lengthlength <= 64

Response Body

Added

application/json

response

A passkey, as its owner sees it.

backed_up*boolean

Whether it syncs to the owner's other devices, as a phone's or a password manager's does; a hardware key does not.

created_at*string

When it was added.

id*string

Stable identifier, for renaming or removing it.

last_used_at?|

When it last signed in, or null if it never has.

name*string

What the owner calls it.

curl -X POST 'https://example.com/api/v1/account/passkeys' \  -H 'Content-Type: application/json' \  -d '{  "credential": {    "id": "string",    "response": {      "attestationObject": "string",      "clientDataJSON": "string"    }  }}'

{  "backed_up": true,  "created_at": "string",  "id": "string",  "last_used_at": "string",  "name": "string"}