Check for a passkey before signing (browser-only, Stage 6E)

BROWSER-ONLY — not an MCP/agent tool. Reports whether the signer's email already has a passkey on file and returns the credential allow-list for navigator.credentials.get(). The authenticate challenge is the deterministic payload hash, so no challenge is issued here. Also creates the signer row (the passkey path has no /otp call to do it). Requires the four session-binding headers with action 'webauthn.authenticate'.

post/api/envelopes/{envelope_id}/webauthn/auth/options

Request

  • Base URL: https://free-sign.com
  • URL: https://free-sign.com/api/envelopes/{envelope_id}/webauthn/auth/options
  • Auth: none declared. Required headers: x-fsig-session-signature, x-fsig-session-nonce, x-fsig-session-timestamp, x-fsig-session-action

Path parameters

envelope_idstring required

Headers

x-fsig-session-signaturestring required

Base64url ECDSA P-256 signature over canonicalJson({action, envelope_id, nonce, timestamp}). Produced by the non-extractable session keypair bound to this envelope at creation. See invariant #11 in CLAUDE.md.

x-fsig-session-noncestring required

Random 32-hex-char nonce, fresh per request.

x-fsig-session-timestampstring date-time required

ISO-8601 UTC timestamp of the request. Accepted within +/-5 minutes of server clock.

x-fsig-session-action'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate' required

Action name matching the route. Must equal the action field in the signed canonical payload. The webauthn.* actions gate the browser-only passkey endpoints.

Request body

signer_emailstring email required

Response

{ signer_id, email_hmac, rp_id }. Deliberately does NOT disclose whether the email has a passkey or any credential id — passkeys are discoverable (resident) credentials, so the browser authenticates with an empty allowCredentials list and falls back to OTP if the OS reports none.

signer_idstring required
email_hmacstring
rp_idstring required

Changes

No recorded changes to this operation across all 1 revision of this API.