Auth

Verify passkey login

Verifies a WebAuthn assertion and returns a normal auth session. Rate-limited by project, RP ID, IP, and invalid challenge attempts before challenge consumption. The JWT includes amr=[passkey], aal=aal2, auth_time, and passkey_id.

post/auth/v1/passkeys/login/verify

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/auth/v1/passkeys/login/verify
  • Auth: API key in header apikey

Request body

challenge_idstring uuid required
responseobject required

PublicKeyCredential JSON from the browser.

Response

Session issued

access_tokenstring required
token_type'bearer' required
expires_ininteger required
refresh_tokenstring required
elevation_requiredboolean

True when project_admin was downgraded until passkey auth.

required_method'passkey'
effective_role'authenticated'
intended_role'project_admin'
providerstring

Example response

{
  "expires_in": 3600,
  "provider": "google"
}

Changes

No recorded changes to this operation across all 1 revision of this API.