authentication
verification

Verify Webauthn sign-up

Changed on

Complete the Webauthn sign-up process by verifying the response from the user's device. Returns a session if validation is successful.

post/signup/webauthn/verify

Request

  • Base URL
    https://{subdomain}.auth.{region}.nhost.run/v1
  • URL
    https://{subdomain}.auth.{region}.nhost.run/v1/signup/webauthn/verify
  • Auth
    none declared

Request body

nicknamestring

Nickname for the security key

codeChallengestring

PKCE code challenge (S256). When provided and email verification is required, the verification redirect will contain an authorization code instead of a refresh token.

Example request

{
  "options": {
    "allowedRoles": [
      "me",
      "user"
    ],
    "defaultRole": "user",
    "displayName": "John Smith",
    "locale": "en",
    "metadata": {
      "firstName": "John",
      "lastName": "Smith"
    },
    "redirectTo": "https://my-app.com/catch-redirection"
  }
}

Response

Sign up successful

Example response

{
  "session": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "accessTokenExpiresIn": 900,
    "refreshTokenId": "2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24",
    "refreshToken": "2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24",
    "user": {
      "avatarUrl": "https://myapp.com/avatars/user123.jpg",
      "createdAt": "2023-01-15T12:34:56Z",
      "defaultRole": "user",
      "displayName": "John Smith",
      "email": "john.smith@nhost.io",
      "emailVerified": true,
      "id": "2c35b6f3-c4b9-48e3-978a-d4d0f1d42e24",
      "locale": "en",
      "metadata": {
        "firstName": "John",
        "lastName": "Smith"
      },
      "phoneNumber": "+12025550123",
      "roles": [
        "user",
        "customer"
      ]
    }
  }
}

Changes

    • breaking

      the response property // became nullable for the status

    • warning

      added the new otp-too-many-attempts enum value to the response property for the response status