---
title: "Check for a passkey before signing (browser-only, Stage 6E)"
method: POST
path: "/api/envelopes/{envelope_id}/webauthn/auth/options"
---

# Check for a passkey before signing (browser-only, Stage 6E)

`POST /api/envelopes/{envelope_id}/webauthn/auth/options`

## Request

- Base URL: `https://free-sign.com`
- URL: `https://free-sign.com/api/envelopes/{envelope_id}/webauthn/auth/options`
- Auth: none declared. Required headers: `x-fsig-session-signature`, `x-fsig-session-nonce`, `x-fsig-session-timestamp`, `x-fsig-session-action`

BROWSER-ONLY — not an MCP/agent tool. Reports whether the signer's email already has a passkey on file and returns the credential allow-list for navigator.credentials.get(). The authenticate challenge is the deterministic payload hash, so no challenge is issued here. Also creates the signer row (the passkey path has no /otp call to do it). Requires the four session-binding headers with action 'webauthn.authenticate'.

## Path parameters

- `envelope_id` string, required

## Headers

- `x-fsig-session-signature` string, required
- `x-fsig-session-nonce` string, required
- `x-fsig-session-timestamp` string, date-time, required
- `x-fsig-session-action` 'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate', required

## Request body

- object
  - `signer_email` string, email, required

## Response `200`

{ signer_id, email_hmac, rp_id }. Deliberately does NOT disclose whether the email has a passkey or any credential id — passkeys are discoverable (resident) credentials, so the browser authenticates with an empty allowCredentials list and falls back to OTP if the OS reports none.

- object
  - `signer_id` string, required
  - `email_hmac` string
  - `rp_id` string, required

---

[API](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api.md) · [All operations](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/llms.txt) · [OpenAPI document](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/revisions/5d8e9854ab85?raw)