---
title: "Passkey Registration Verify"
method: POST
path: "/v1/auth/passkeys/register/verify"
tags: ["Auth: Passkeys"]
---

# Passkey Registration Verify

`POST /v1/auth/passkeys/register/verify`

## Request

- Base URL: `https://api.robosystems.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.robosystems.ai/v1/auth/passkeys/register/verify`
- Auth: none declared

Finish enrollment. The first passkey returns recovery codes (once); the forced-enrollment lane also completes the login.

## Request body

- PasskeyRegisterVerifyRequest: Finish enrollment with the authenticator's attestation response.
  - `credential` object, required: WebAuthn registration credential (browser JSON, opaque)
  - `name` string, nullable: User-facing label for this passkey
  - `mfa_token` string, nullable: Enrollment token when finishing a forced enrollment

## Response `200`

Successful Response

- PasskeyRegisterVerifyResponse: Enrollment result; the first passkey also carries recovery codes and, in the forced-enrollment lane, the completed login.
  - `passkey` PasskeyInfo, required: One enrolled passkey, as listed in account settings.
    - `id` string, required: Passkey identifier
    - `name` string, required: User-facing label
    - `created_at` string, required: Enrollment time (ISO 8601)
    - `last_used_at` string, nullable: Last successful assertion time (ISO 8601)
    - `backup_eligible` boolean, required: Whether the credential is synced (multi-device) capable
    - `backup_state` boolean, required: Whether the credential is currently backed up
  - `recovery_codes` string[], nullable: Single-use recovery codes — returned exactly once, at first enrollment
  - `auth` AuthResponse: Authentication response model.
    - `user` object, required: User information
    - `org` object, nullable: Organization information (personal org created automatically on registration)
    - `message` string, required: Success message
    - `status` 'authenticated' | 'mfa_required' | 'mfa_enrollment_required': Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present)
    - `mfa_token` string, nullable: Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
    - `token` string, nullable: JWT authentication token (optional for cookie-based auth)
    - `expires_in` integer, nullable: Token expiry time in seconds from now
    - `refresh_threshold` integer, nullable: Recommended refresh threshold in seconds before expiry

## Other responses

- `400`: Registration failed
- `401`: Authentication required
- `422`: Validation Error
- `429`: Rate limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/robosystems/apis/robosystems-api.md) · [All operations](https://skmtc.dev/robosystems/apis/robosystems-api/llms.txt) · [OpenAPI document](https://skmtc.dev/robosystems/apis/robosystems-api/revisions/e661e2d5ca6a?raw)