---
title: "Passwordless Login Verify"
method: POST
path: "/v1/auth/passkeys/login/verify"
tags: ["Auth: Passkeys"]
---

# Passwordless Login Verify

`POST /v1/auth/passkeys/login/verify`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/auth/passkeys/login/verify`
- Auth: none declared

Complete a passwordless login. A user-verified passkey assertion is two factors in one gesture.

## Request body

- PasskeyLoginVerifyRequest: Complete a passwordless login with a discoverable-credential assertion.
  - `assertion` object, required: WebAuthn assertion (browser JSON, opaque)

## Response `200`

Successful Response

- AuthResponse: Authentication response model.
  - `user` object, required: User information
  - `org` object, nullable: Organization information (personal org created automatically on registration)
  - `message` string, required: Success message
  - `status` 'authenticated' | 'mfa_required' | 'mfa_enrollment_required': Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present)
  - `mfa_token` string, nullable: Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
  - `token` string, nullable: JWT authentication token (optional for cookie-based auth)
  - `expires_in` integer, nullable: Token expiry time in seconds from now
  - `refresh_threshold` integer, nullable: Recommended refresh threshold in seconds before expiry

## Other responses

- `400`: Invalid request
- `401`: Verification failed
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)