---
title: "Create passkey login options"
method: POST
path: "/auth/v1/passkeys/login/options"
tags: ["Auth"]
---

# Create passkey login options

`POST /auth/v1/passkeys/login/options`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/passkeys/login/options`
- Auth: API key in header `apikey`

Creates a WebAuthn login challenge. Optional email hints are accepted, but options remain discoverable and do not expose allowCredentials.

## Request body

- object
  - `app_origin` string, uri, required: Exact allowed app origin for the WebAuthn ceremony.
  - `email` string, email

## Response `200`

Login options

- PasskeyOptionsResponse
  - `challenge_id` string, uuid, required
  - `options` object, required: Opaque WebAuthn PublicKeyCredentialCreationOptions or PublicKeyCredentialRequestOptions JSON returned by @simplewebauthn/server.

## Other responses

- `400`: Invalid app_origin
- `429`: Rate limited

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)