---
title: "Verify passkey registration"
method: POST
path: "/auth/v1/passkeys/register/verify"
tags: ["Auth"]
---

# Verify passkey registration

`POST /auth/v1/passkeys/register/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/passkeys/register/verify`
- Auth: API key in header `apikey` and HTTP bearer

Verifies a WebAuthn registration response and stores the caller's passkey.

## Request body

- object
  - `challenge_id` string, uuid, required
  - `response` object, required: PublicKeyCredential JSON from the browser.
  - `label` string, nullable

## Response `201`

Passkey registered

- PasskeyRecord
  - `id` string, uuid, required
  - `rp_id` string, required
  - `created_origin` string, uri, required
  - `last_used_origin` string, uri, nullable
  - `transports` string[], required
  - `label` string, nullable, required
  - `credential_device_type` string, nullable, required
  - `credential_backed_up` boolean, nullable, required
  - `created_at` string, date-time, required
  - `last_used_at` string, date-time, nullable, required

## Other responses

- `400`: Bad request
- `401`: Missing or invalid authentication. Run402-originated JSON bodies use the canonical ErrorEnvelope.
- `403`: Recent passkey auth required for admin passkey mutation
- `429`: Rate limited

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)