---
title: "Hosted WebAuthn login verify (mints the session cookie)"
method: POST
path: "/auth/passkeys/login/verify"
tags: ["Auth"]
---

# Hosted WebAuthn login verify (mints the session cookie)

`POST /auth/passkeys/login/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/passkeys/login/verify`
- Auth: none declared

Hosted passkey-login ceremony terminal. Verifies the WebAuthn assertion, mints the browser-session cookie (amr: passkey) via Set-Cookie, and returns { ok, redirect_to } for the JS client to navigate. No JWT is issued — machine clients use /auth/v1/passkeys/login/verify.

## Request body

- object
  - `challenge_id` string, required
  - `response` object, required
  - `return_to` string

## Response `200`

{ ok, redirect_to } plus a Set-Cookie session.

- object

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)