Skip to main content
POST
Complete passkey authentication
No signed-in session is required. Endpoint-specific tokens, setup secrets or challenges may still be required. Verifies AuthenticationResponseJSON, consumes the challenge, and either creates a session or renews recent authentication. Request conventions · API keys · MCP connections

Body

application/json
challengeId
string
required
Pattern: ^[A-Za-z0-9_-]{43}$
response
object
required

WebAuthn AuthenticationResponseJSON from the browser

Response

Successful response. Examples are illustrative; field values vary by record.

user
object
workspace
object