---
title: "Get WebAuthn authentication options"
method: POST
path: "/auth/webauthn/authentication-options"
tags: ["Auth"]
---

# Get WebAuthn authentication options

`POST /auth/webauthn/authentication-options`

Retrieve WebAuthn authentication challenge and options for passwordless login with biometrics or security keys.

## Response `200`

Success

- WebAuthnAuthenticationOptionsResponse
  - `challenge` string, required
  - `timeout` number
  - `rpId` string
  - `allowCredentials` object[]
    - `id` string, required
    - `type` 'public-key', required
    - `transports` string[]
  - `userVerification` 'discouraged' | 'preferred' | 'required'

## Other responses

- `400` — Bad Request - The request was malformed or contained invalid data
- `429` — Too Many Requests - You are being rate limited
- `500` — Internal Server Error - An unexpected error occurred

## Changes

> 14 revisions in range; 1 not diffed.

- **2026-09-06** `a52a2cf49d9b` — 16 warning, 100 info
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `400`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `500`
  - added the new `PHONE_COUNTRY_NOT_SUPPORTED` enum value to the `code` response property for the response status `400`
  - added the new `PHONE_COUNTRY_NOT_SUPPORTED` enum value to the `code` response property for the response status `500`
  - …112 more
  - …this revision’s changelog is incomplete
- **2026-09-05** `4dbb738a3e22` — 2 info
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `400`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `500`
- **2026-09-03** `fa36b1b48ca5` — 10 info
  - removed the `INVALID_PACK_TYPE` enum value from the `code` response property for the response status `400`
  - removed the `INVALID_PACK_TYPE` enum value from the `code` response property for the response status `500`
  - removed the `MAX_PACKS` enum value from the `code` response property for the response status `400`
  - removed the `MAX_PACKS` enum value from the `code` response property for the response status `500`
  - …6 more

[Change history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/auth/webauthn/authentication-options/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) · [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/a54a86d62719?raw)