---
title: "Verify the touch and return proof of it"
method: POST
path: "/v1/platform/connections/{connectionId}/passkeys/tx-assert/complete"
tags: ["Platform"]
---

# Verify the touch and return proof of it

`POST /v1/platform/connections/{connectionId}/passkeys/tx-assert/complete`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/platform/connections/{connectionId}/passkeys/tx-assert/complete`
- Auth: HTTP bearer

Verifies the assertion — origin, rpIdHash, the user-verified
flag, the signature, and a sign count that must increase, which
is what catches a cloned authenticator — and returns a
short-lived token proving this user touched their authenticator
over that digest.

The token records that a platform app requested it. That
provenance is deliberate: it proves the touch to your
application, and it is **refused** as authorization for a
1Claw treasury transfer. A user consenting to your action has
not consented to moving funds, and those remain a separate
assertion from the user's own session.

## Path parameters

- `connectionId` string, uuid, required

## Request body

- object
  - `credential_id` string, required
  - `authenticator_data` string, required
  - `client_data_json` string, required
  - `signature` string, required

## Response `200`

Assertion verified

- object
  - `passkey_token` string, required: Single-use proof of the touch, bound to the digest and to this user.
  - `expires_in` integer, required: Seconds until the token expires.

## Other responses

- `400`: Invalid request
- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)