---
title: "Authenticate Passkey"
method: POST
path: "/v1/auth/webauthn/authenticate"
tags: ["auth"]
---

# Authenticate Passkey

`POST /v1/auth/webauthn/authenticate`

Verify an assertion and set the HttpOnly session cookie.

The session is bound to the identity whose passkey signed, exactly as a
password sign-in binds one to the identity that authenticated, so every
request it later authenticates resolves the same caller.

A refusal is counted like the other sign-in failures
(``record_auth_failure``) and answered as a 401 by the tenancy error
handler. Unlike the password path there is no separate post-failure
throttle: this route is throttled unconditionally on the way in, because
unlike a password there is no legitimate caller here whose correct
credential must never be blocked (a passkey ceremony is one round trip a
browser drives, not something a person retries by hand).

**Maintenance mode freezes this the way it freezes the password sign-in.**
The freeze is on starting a session, not on a credential, so a passkey has
to answer to it or the switch is bypassable by anybody holding one, which is
the whole population it exists to hold off during a redeploy. Refused before
the assertion is verified, so a frozen deployment does no crypto and counts
no auth failure: nobody failed to authenticate, the gateway declined to try.

## Request body

- AuthenticatePasskeyRequest — A completed sign-in ceremony.
  - `credential` object, required — The browser's PublicKeyCredential assertion, serialized.

## Response `200`

Successful Response

- PasskeySessionResponse — A dashboard session minted by a passkey (the token travels only in the cookie). The same three fields ``POST /v1/auth/session`` answers, deliberately: the dashboard's sign-in path does not care which credential got it here.
  - `active_organization_id` string, uuid, required — The organization that identity is acting in, which scopes every tenancy surface.
  - `expires_at` string, date-time, required — When the session cookie stops being accepted.
  - `user_id` string, uuid, required — The identity this session speaks for.

## Other responses

- `422` — Validation Error

## Changes

- **2026-08-24** `bd0edfaa8297` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/auth/webauthn/authenticate/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/7f178e92b56c/schema)