Sign in
auth

Registration Options

Changed on

Start registering a passkey for the signed-in identity.

A POST rather than a GET even though it reads like one: it issues a server-side challenge and writes it, so it is not safe to repeat, cache, or prefetch.

post/api/v1/auth/webauthn/register/options

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header Otari-Key
    • API key in header x-api-key

Response

Successful Response

CeremonyOptions required

The PublicKeyCredentialCreationOptions/RequestOptions a browser needs.

Passed through as an opaque object rather than modeled field by field. The shape is the W3C's, the browser is the only consumer, and it is what navigator.credentials is handed verbatim after the two base64url fields are decoded. Restating it here would produce a second, slightly wrong copy of a spec this deployment does not own, and every field the library adds later would have to be added again to keep the client from dropping it.

Changes