---
title: "Complete passkey sign-in"
method: POST
path: "/api/auth/passkey/finish"
tags: ["Authentication"]
---

# Complete passkey sign-in

`POST /api/auth/passkey/finish`

## Request

- Base URL: `https://slimlytics.com`
- URL: `https://slimlytics.com/api/auth/passkey/finish`
- Auth: none required

## Request body

- PasskeyAssertion
  - `challengeId` string, uuid, required
  - `credential` object, required: Serialized PublicKeyCredential from navigator.credentials.get()

## Response `200`

Signed in; the session counts as MFA-verified

- TokenResponse
  - `token` string, required: Short-lived session JWT (Bearer access token)
  - `refreshToken` string, required: Opaque `slrt_` refresh token. Single use: every refresh returns a new one. Sessions stay signed in for 30 idle days (365 days at most).
  - `expiresIn` integer, required: Access token lifetime in seconds

## Other responses

- `400`: Invalid request
- `401`: Authentication required
- `500`: Internal service error

---

[API](https://skmtc.dev/slimlytics/apis/slimlytics-api.md) · [All operations](https://skmtc.dev/slimlytics/apis/slimlytics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/slimlytics/apis/slimlytics-api/revisions/f9a26641a254?raw)