Sign in
auth

Complete a passkey assertion against a login challenge; mints the session.

Changed on

Validates the assertion against the live ceremony, consumes the login challenge, and mints the browser session with webauthn recorded alongside password in the assurance. A signature-count regression disables the cloned credential (audited) and refuses.

post/api/v1/auth/login/challenge/{challenge}/webauthn/finish

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/auth/login/challenge/{challenge}/webauthn/finish
  • Auth: none required

Path parameters

challengestring required

A prefixed UUIDv7, e.g. org_0198….

Login-challenge identifier returned by localLogin (202).

Request body

WebauthnResponse required

Opaque WebAuthn authenticator response (attestation or assertion) as produced by the browser, passed to the relying party as raw bytes.

Response

The minted browser session.

session_tokenstring

The bearer value, returned exactly once. A replayable credential: cookie attributes constrain browsers, not an attacker holding the value, which is why lifetimes are short and revocation is a delete. OMITTED for a browser-artifact session: that token is delivered ONLY on the __Host-hikyo HttpOnly cookie so injected same-origin script cannot read it. A CLI-artifact session, which has no cookie channel, still carries it here.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status