---
title: "Authorize a pay session with a passkey assertion"
method: POST
path: "/v1/pay-sessions/{session_id}/authorize"
tags: ["Pay"]
---

# Authorize a pay session with a passkey assertion

`POST /v1/pay-sessions/{session_id}/authorize`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/pay-sessions/{session_id}/authorize`
- Auth: HTTP bearer

Called by the authorize page after the person touches their authenticator. The assertion is redeemed here against this session's own payment digest and the session is marked authorized; no token is handed back to be polled for, so nothing worth stealing is left in the row. Requires the token of the human the session was raised for.

## Path parameters

- `session_id` string, uuid, required

## Headers

- `X-Passkey-Token` string, required

## Response `200`

Session authorized

## Other responses

- `403`: Not a human caller, the session belongs to someone else, or the assertion does not authorize this payment.

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)