---
title: "Hosted WebAuthn registration verify (re-mints the session cookie)"
method: POST
path: "/auth/passkeys/register/verify"
tags: ["Auth"]
---

# Hosted WebAuthn registration verify (re-mints the session cookie)

`POST /auth/passkeys/register/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/passkeys/register/verify`
- Auth: API key in cookie `__Host-Http-r402_session`

Hosted passkey-register ceremony terminal for the cookie-authenticated actor (cookie + double-submit CSRF + same-origin). Verifies the registration, persists the passkey, and re-mints the session with amr: passkey (step-up).

## Request body

- object
  - `challenge_id` string, required
  - `response` object, required
  - `label` string

## Response `200`

{ ok } plus a Set-Cookie session (amr: passkey).

- object

## Other responses

- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)