---
title: "Begin passkey authentication"
method: POST
path: "/accounts/begin-auth-with-passkey"
tags: ["Authentication", "Multi-Factor Authentication"]
---

# Begin passkey authentication

`POST /accounts/begin-auth-with-passkey`

## Request

- Base URL: `https://api.quiva.ai`
- URL: `https://api.quiva.ai/accounts/begin-auth-with-passkey`
- Auth: none required
- TypeScript: <https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/docs/accounts/begin-auth-with-passkey/post.ts> (a function with typed inputs; its response is checked against the schema)

Initiates the WebAuthn passkey authentication flow. Returns a challenge for the client to sign with the user's passkey.

## Request body

- BeginAuthWithPasskeyRequest
  - `account` string: Account name (optional)
  - `email` string, email, required: User's email address

## Response `200`

Passkey authentication challenge

- object
  - `data` CredentialAssertion, required: WebAuthn credential assertion options for the client to process
    - `challenge` string: Base64-encoded challenge to be signed by the authenticator
    - `timeout` integer: Time in milliseconds the user has to respond to the authentication prompt
    - `rpId` string: Relying party identifier (usually the domain name)
    - `allowCredentials` object[]: List of credentials that are allowed for this authentication
      - `id` string: Base64-encoded credential ID
      - `type` string: Credential type (e.g., 'public-key')
      - `transports` string[]: List of allowed transports (e.g., 'internal', 'usb')
    - `userVerification` string: User verification requirement (e.g., 'preferred', 'required')

## Other responses

- `400`: Invalid request
- `401`: User not found or passkeys not enabled

## Changes

- **2025-06-12** `4979dfd00eda`: 5 warning, 1 info
  - removed the optional property `allowCredentials` from the response with the `200` status
  - removed the optional property `challenge` from the response with the `200` status
  - removed the optional property `rpId` from the response with the `200` status
  - removed the optional property `timeout` from the response with the `200` status
  - …2 more

[Operation history](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/changes/accounts/begin-auth-with-passkey/post.md)

---

[API](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway.md) - [All operations](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/llms.txt) - [OpenAPI document](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/revisions/700eb1ace61a?raw)