---
title: "Begin passkey verification for this session"
method: POST
path: "/api/auth/mfa/start"
tags: ["Authentication"]
---

# Begin passkey verification for this session

`POST /api/auth/mfa/start`

## Request

- Base URL: `https://slimlytics.com`
- URL: `https://slimlytics.com/api/auth/mfa/start`
- Auth: HTTP bearer

## Response `200`

WebAuthn request options for this account's passkeys

- WebAuthnChallenge
  - `challengeId` string, uuid, required: Single-use ceremony ID; expires after 5 minutes
  - `options` object, required: WebAuthn `publicKey` creation or request options (binary fields are base64url)

## Other responses

- `400`: Invalid request
- `401`: Authentication required
- `403`: Not allowed for this credential (API tokens, non-admins), or error code `mfa_required` when a session that verified a passkey within 12 hours is needed
- `500`: Internal service error

---

[API](https://skmtc.dev/slimlytics/apis/slimlytics-api.md) · [All operations](https://skmtc.dev/slimlytics/apis/slimlytics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/slimlytics/apis/slimlytics-api/revisions/f9a26641a254?raw)