> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Complete passkey registration

> Verifies the browser's RegistrationResponseJSON against the stored challenge, origin and RP ID. The first passkey also returns recoveryCodes.

A signed-in human session with recent authentication is required. Complete password/passkey reauthentication when requested.

Verifies the browser's RegistrationResponseJSON against the stored challenge, origin and RP ID. The first passkey also returns recoveryCodes.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json POST /api/auth/passkeys/register/verify
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /api/auth/passkeys/register/verify:
    post:
      tags:
        - Passkeys and recovery
      summary: Complete passkey registration
      description: >-
        Verifies the browser's RegistrationResponseJSON against the stored
        challenge, origin and RP ID. The first passkey also returns
        recoveryCodes.


        A signed-in human session with recent authentication is required.
        Complete password/passkey reauthentication when requested.
      operationId: post_api_auth_passkeys_register_verify
      parameters:
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Posted UI origin. Required for browser
            mutations carrying session cookies.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                challengeId:
                  type: string
                  pattern: ^[A-Za-z0-9_-]{43}$
                response:
                  type: object
                  propertyNames:
                    type: string
                  additionalProperties: {}
                  description: WebAuthn RegistrationResponseJSON from the browser
                name:
                  type: string
                  minLength: 1
                  maxLength: 120
              required:
                - challengeId
                - response
                - name
              additionalProperties: false
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                additionalProperties: true
              example:
                ok: true
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: posted_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.