Sign in with a passkey: verify its assertion and return a session token to present as a bearer (F-028). Authenticated by the assertion it carries.

POST

/v1/auth/passkey

const url = 'https://example.com/v1/auth/passkey';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"assertion":{"authenticator_data":"example","client_data_json":"example","raw_id":"example","signature":"example"},"credential":"example"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/v1/auth/passkey \
  --header 'Content-Type: application/json' \
  --data '{ "assertion": { "authenticator_data": "example", "client_data_json": "example", "raw_id": "example", "signature": "example" }, "credential": "example" }'

Request Body^required

application/json

POST /v1/auth/passkey (F-028): sign in with a passkey.

object

assertion

required

The assertion over a challenge with purpose authenticate.

object

authenticator_data

required

response.authenticatorData, base64url.

string

client_data_json

required

response.clientDataJSON, base64url.

string

raw_id

required

rawId, base64url.

string

signature

required

response.signature, base64url (DER).

string

credential

required

The credential, did:aledgent:cred:….

string

Example^generated

{
  "assertion": {
    "authenticator_data": "example",
    "client_data_json": "example",
    "raw_id": "example",
    "signature": "example"
  },
  "credential": "example"
}

Responses

200

A session token: present it as a bearer until expires_at. It is a secret.

application/json

A session (F-028): present session as a bearer token until expires_at. It is a secret.

object

credential

required

The passkey it signed in with.

string

expires_at

required

When it expires.

integer format: uint64

principal

required

The identity it authenticates.

string

session

required

The session token.

string

Example^generated

{
  "credential": "example",
  "expires_at": 1,
  "principal": "example",
  "session": "example"
}

4XX

Refused, with the named condition. The status is the alternative’s x-http-status.

application/json

One of:

ERR-NotAuthorised

object

description

required

Allowed value: The initiating principal holds no authority that covers this operation, account, asset or bound

error

required

Allowed value: ERR-NotAuthorised

Example

{
  "description": "The initiating principal holds no authority that covers this operation, account, asset or bound",
  "error": "ERR-NotAuthorised"
}

5XX

Refused, with the named condition. The status is the alternative’s x-http-status.

application/json

One of:

ERR-NotAuthorised

object

description

required

Allowed value: The initiating principal holds no authority that covers this operation, account, asset or bound

error

required

Allowed value: ERR-NotAuthorised

Example

{
  "description": "The initiating principal holds no authority that covers this operation, account, asset or bound",
  "error": "ERR-NotAuthorised"
}

Headers

Retry-After

integer

On ERR-DecisionUnavailable (503): seconds to wait before retrying with the same client key (DEC-27 (g)).

Sign in with a passkey: verify its assertion and return a session token to present as a bearer (F-028). Authenticated by the assertion it carries.

Request Bodyrequired

Examplegenerated

Responses

200

Examplegenerated

4XX

Example

5XX

Example

Headers

Request Body^required

Example^generated

Example^generated