---
title: "W272 — the direct grant: a passkey assertion (or fresh registration) performed ON a registered relying party's page (WebAuthn related origins) becomes a one-time authorization code. CORS-scoped to the origin registered for client_id; PKCE S256; auth-throttled."
method: POST
path: "/auth/authorize/direct"
tags: ["auth"]
---

# W272 — the direct grant: a passkey assertion (or fresh registration) performed ON a registered relying party's page (WebAuthn related origins) becomes a one-time authorization code. CORS-scoped to the origin registered for client_id; PKCE S256; auth-throttled.

`POST /auth/authorize/direct`

## Request

- Base URL: `https://obeliskgate.com`
- URL: `https://obeliskgate.com/auth/authorize/direct`
- Auth: none declared

## Request body

- object
  - `client_id` string: string
  - `redirect_uri` string: string
  - `code_challenge` unknown
  - `code_challenge_method` unknown
  - `state` string: string
  - `nonce` unknown
  - `assertion` unknown
  - `registration` unknown

## Response `200`

Success.

## Other responses

- `default`: Error — { ok:false, reason:<code>, message?:<human> } on failures; HTTP status mirrors it.

---

[API](https://skmtc.dev/obeliskgate/apis/obelisk-api.md) · [All operations](https://skmtc.dev/obeliskgate/apis/obelisk-api/llms.txt) · [OpenAPI document](https://skmtc.dev/obeliskgate/apis/obelisk-api/revisions/b99b2069699b?raw)