---
title: "Verify passkey login"
method: POST
path: "/auth/v1/passkeys/login/verify"
tags: ["Auth"]
---

# Verify passkey login

`POST /auth/v1/passkeys/login/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/passkeys/login/verify`
- Auth: API key in header `apikey`

Verifies a WebAuthn assertion and returns a normal auth session. Rate-limited by project, RP ID, IP, and invalid challenge attempts before challenge consumption. The JWT includes amr=[passkey], aal=aal2, auth_time, and passkey_id.

## Request body

- object
  - `challenge_id` string, uuid, required
  - `response` object, required: PublicKeyCredential JSON from the browser.

## Response `200`

Session issued

- AuthSessionResponse
  - `access_token` string, required
  - `token_type` 'bearer', required
  - `expires_in` integer, required
  - `refresh_token` string, required
  - `user` object, required
    - `id` string, uuid, required
    - `email` string, email, required
    - `email_verified_at` string, date-time, nullable
    - `display_name` string, nullable
    - `avatar_url` string, nullable
  - `elevation_required` boolean: True when project_admin was downgraded until passkey auth.
  - `required_method` 'passkey'
  - `effective_role` 'authenticated'
  - `intended_role` 'project_admin'
  - `provider` string
  - `magic_link` object
    - `intent` 'signin' | 'invite' | 'claim' | 'recovery'
    - `client_state` string, nullable
    - `state_source` 'anonymous' | 'service_key'
    - `state_trusted` boolean
    - `delivery` 'link' | 'code' | 'both'
    - `verified_with` 'link' | 'email_code'

## Other responses

- `400`: Bad request
- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.
- `429`: Rate limited

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)