---
title: "Generate Authentication Options"
method: POST
path: "/user-authenticators/passkey/authentication-options"
tags: ["Passkeys"]
---

# Generate Authentication Options

`POST /user-authenticators/passkey/authentication-options`

Generate options to authenticate with an existing passkey.

## Request body

- object
  - `challengeId` string — The ID of the challenge returned by Initiate Challenge. Only required if you want to customize the action code associated with the passkey sign-in.
  - `username` string — If passed, will restrict the allowed credentials for the passkey sign-in to those associated with the given username. Recommended for when using passkeys for MFA or step-up authentication.
  - `securePaymentConfirmation` boolean — Request a Secure Payment Confirmation (SPC) ceremony for a 3-D Secure payment. When true, the response offers only payment-capable credentials and includes the `payment` transaction set server-side via `track` custom data.

## Response `200`

OK

- object
  - `challengeId` string, required — The ID of the passkey challenge. Should be passed back to the complete the challenge.
  - `options` object, required — The options for public key credential authentication, including rpId and challenge.
  - `payment` object — For a Secure Payment Confirmation request, the transaction set server-side on the action (via `track` custom data) that the cardholder is asked to confirm. The client renders these values; it does not supply them.
    - `amount` string — The transaction amount as a decimal string, e.g. "42.00".
    - `currency` string — The ISO-4217 currency code, e.g. "USD".
    - `payeeName` string — The display name of the payee / merchant.
    - `payeeOrigin` string — The origin of the payee, e.g. "https://merchant.example".
  - `paymentInstruments` object[] — For a Secure Payment Confirmation request, the persisted instrument label for each payment-capable credential, used as the SPC instrument in the payment dialog.
    - `credentialId` string — The ID of the payment-capable passkey credential.
    - `displayName` string — The instrument label, e.g. "Visa ••1234".

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)