---
title: "Verify Registration"
method: POST
path: "/user-authenticators/passkey"
tags: ["Passkeys"]
---

# Verify Registration

`POST /user-authenticators/passkey`

Finish the process of registering a new passkey authenticator.

## Request body

- object
  - `challengeId` string, required — The ID of the passkey challenge returned when generating registration options.
  - `registrationCredential` object, required — The registration credential object, based on https://w3c.github.io/webauthn/#dictdef-registrationresponsejson.
  - `conditionalCreate` boolean — Whether the registration used the automatic passkey upgrade / conditional create flow.

## Response `200`

OK

- object
  - `isVerified` boolean, required — True if the passkey challenge was valid and the device was enrolled successfully.
  - `accessToken` string — A new short-term token with scopes to manage authenticators (e.g. add secondary authenticators, remove authenticators, view or regenerate recovery codes). Only present if the challenge succeeded.
  - `userAuthenticatorId` string — The ID of the user's new authenticator which is associated with the passkey credential.
  - `userId` string — The ID of the Authsignal user associated with the passkey.
  - `userAuthenticator` UserAuthenticator
    - `userAuthenticatorId` string, required
    - `verificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE', required
    - `email` string
    - `phoneNumber` string
    - `username` string
    - `displayName` string
    - `createdAt` string, date-time, required
    - `verifiedAt` string, date-time
    - `lastVerifiedAt` string, date-time
    - `previousSmsChannel` 'DEFAULT' | 'WHATSAPP' — The channel that was last used by the user to complete an SMS challenge. Only defined if the verification method is SMS.
    - `webauthnCredential` object
      - `credentialId` string
      - `deviceId` string
      - `name` string — The name of the passkey. Defaults to `aaguidMapping.name` if available.
      - `aaguid` string
      - `aaguidMapping` object
        - `name` string — The name of the credential manager where the passkey is stored e.g. 'iCloud Keychain'.
        - `svgIconLight` string — A base64 encoded light variant SVG icon for the credential manager.
        - `svgIconDark` string — A base64 encoded dark variant SVG icon for the credential manager.
      - `credentialBackedUp` boolean
      - `credentialDeviceType` 'singleDevice' | 'multiDevice'
      - `authenticatorAttachment` 'cross-platform' | 'platform'
      - `parsedUserAgent` object
        - `ua` string
        - `browser` object
          - `name` string
          - `version` string
          - `major` string
        - `device` object
          - `model` string
          - `type` string
          - `vendor` string
        - `engine` object
          - `name` string
          - `version` string
        - `os` object
          - `name` string
          - `version` string
        - `cpu` object
          - `architecture` string
    - `deviceName` string — The name of the device (e.g. 'iPhone 16 Pro'). Only used for PUSH verification methods.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)