---
title: "Verify Authentication"
method: POST
path: "/verify/passkey"
tags: ["Passkeys"]
---

# Verify Authentication

`POST /verify/passkey`

Finish the process of authenticating with an existing passkey authenticator.

## Request body

- object
  - `challengeId` string, required — The ID of the passkey challenge returned when generating authentication options.
  - `authenticationCredential` object, required — The authentication credential object, based on https://w3c.github.io/webauthn/#dictdef-authenticationresponsejson.
  - `deviceId` string — The ID of the device.

## Response `200`

OK

- object
  - `isVerified` boolean, required — True if the passkey challenge was valid and the device was authenticated successfully.
  - `accessToken` string — A token which can be used to validate the passkey challenge server-side.
  - `userId` string — The ID of the Authsignal user associated with the passkey.
  - `userAuthenticatorId` string — The ID of the user's authenticator which is associated with the passkey credential.
  - `username` string — The username associated with the passkey.
  - `userDisplayName` string — The display name associated with the passkey.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)