---
title: "Authentication Options"
method: POST
path: "/v1/auth/webauthn/authenticate/options"
tags: ["auth"]
---

# Authentication Options

`POST /v1/auth/webauthn/authenticate/options`

Start a passkey sign-in. Public, throttled, and names no credentials.

The options carry no ``allowCredentials``, so this publishes nothing about
who holds a passkey here; see ``webauthn_service.begin_authentication``.

## Response `200`

Successful Response

- CeremonyOptions — The `PublicKeyCredentialCreationOptions`/`RequestOptions` a browser needs. Passed through as an opaque object rather than modeled field by field. The shape is the W3C's, the browser is the only consumer, and it is what ``navigator.credentials`` is handed verbatim after the two base64url fields are decoded. Restating it here would produce a second, slightly wrong copy of a spec this deployment does not own, and every field the library adds later would have to be added again to keep the client from dropping it.

## Changes

- **2026-08-24** `bd0edfaa8297` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/auth/webauthn/authenticate/options/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/1a5cf829e593/schema)