---
title: "Complete passkey authentication"
method: POST
path: "/accounts/complete-auth-with-passkey"
tags: ["Authentication", "Multi-Factor Authentication"]
---

# Complete passkey authentication

`POST /accounts/complete-auth-with-passkey`

## Request

- Base URL: `https://api.quiva.ai`
- URL: `https://api.quiva.ai/accounts/complete-auth-with-passkey`
- Auth: none required
- TypeScript: <https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/docs/accounts/complete-auth-with-passkey/post.ts> (a function with typed inputs; its response is checked against the schema)

Completes the WebAuthn passkey authentication flow by verifying the signed challenge.

## Request body

- CompleteAuthWithPasskeyRequest
  - `account` string: Account name
  - `token` string: MFA token
  - `credential` string, required: WebAuthn credential
  - `email` string: User email
  - `remember_device` boolean: Remember this device for 30 days. The response then carries `device_token`.

## Response `200`

Authentication successful

- object
  - `data` AuthResponse, required: Tokens and the signed-in user and account.
    - `refresh_token` string: Refresh token
    - `auth_token` string: Authentication token (JWT)
    - `passkey_enabled` boolean
    - `totp_enabled` boolean
    - `first_sign_in` boolean: True on the first sign-in after an invitation; the app routes it to MFA setup
    - `account` AccountPublicInfo
      - `name` string: Account name (normalized)
      - `id` string: Account unique identifier - 10 digits
      - `display_name` string: Account display name
      - `root_email` string, email: Root user email address
      - `subscription_status` 'active' | 'pending' | 'cancelled': Subscription status
      - `subscription_plan` string: Subscription plan
      - `emergency_credit` number, float: Emergency credit amount
      - `country` string: Country
      - `company_name` string: Company name
      - `address` string: Address
      - `website` string: Website
      - `phone_number` string: Phone number
      - `scheduled_for_deletion` boolean: Whether the account is scheduled for deletion
      - `deletion_date` string, date-time: If the account is scheduled for deletion, it will be deleted on this date
      - `region` string: Region
      - `provider` string: Provider
      - `bstier` integer: BS tier
      - `cloud` boolean: Cloud functionality enabled. It true, the user has access to quiva.ai Cloud
      - `hub` boolean: Hub functionality enabled. It true, the user has access to quiva.ai Hub
    - `user` string, email: User email
    - `user_id` string
    - `first_name` string
    - `last_name` string
    - `role` string: Role on the signed-in account
    - `mfa` MfaInfo
      - `passkey_enabled` boolean, required: Whether passkey authentication is enabled
      - `totp_enabled` boolean, required: Whether TOTP authentication is enabled
    - `theme` string
    - `sound` boolean
    - `advanced_mode` boolean
    - `voice_transcription` boolean
    - `onboarding_progress` object
    - `timezone` string
    - `notification_preferences` object
    - `folder` string: Set for client users filed under a folder
    - `device_token` string: Present when `remember_device` was set on an MFA step. Send it as `device_token` on later password sign-ins.

## Other responses

- `401`: Invalid credential or verification failed

## Changes

- **2026-11-12** `700eb1ace61a`: 18 info
  - added the new optional request property `remember_device`
  - added the optional property `data/account` to the response with the `200` status
  - added the optional property `data/advanced_mode` to the response with the `200` status
  - added the optional property `data/device_token` to the response with the `200` status
  - …14 more
- **2025-06-12** `4979dfd00eda`: 4 warning, 1 info
  - removed the optional property `auth_token` from the response with the `200` status
  - removed the optional property `passkey_enabled` from the response with the `200` status
  - removed the optional property `refresh_token` from the response with the `200` status
  - removed the optional property `totp_enabled` from the response with the `200` status
  - …1 more
- **2025-06-10** `964e2801b73d`: 2 breaking, 3 info
  - added the new required request property `credential`
  - the request's body type changed from no type to `object`
  - added the new optional request property `account`
  - added the new optional request property `email`
  - …1 more

[Operation history](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/changes/accounts/complete-auth-with-passkey/post.md)

---

[API](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway.md) - [All operations](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/llms.txt) - [OpenAPI document](https://skmtc.dev/quivaworks/apis/quiva-ai-gateway/revisions/700eb1ace61a?raw)