STstytch
Webauthn

Authenticatestart

Changed on

Initiate the authentication of a Passkey or WebAuthn registration.

To optimize for Passkeys, set the return_passkey_credential_options field to true.

After calling this endpoint, the browser will need to call navigator.credentials.get() with the data from public_key_credential_request_options passed to the navigator.credentials.get() request via the public key argument.

When using built-in browser methods like navigator.credentials.get(), set the use_base64_url_encoding option to true.

See our WebAuthn setup guide for additional usage instructions and example code.

post/v1/webauthn/authenticate/start

Request

  • Base URL
    https://api.stytch.com
  • Auth
    HTTP basic

Request body

domainstring required

The domain for Passkeys or WebAuthn. Defaults to window.location.hostname.

user_idstring

The user_id of an active user the Passkey or WebAuthn registration should be tied to. You may use an external_id here if one is set for the user.

return_passkey_credential_optionsboolean

If true, the public_key_credential_creation_options returned will be optimized for Passkeys with userVerification set to "preferred".

use_base64_url_encodingboolean

If true, values in the public_key_credential_creation_options will be base64 URL encoded. Set this option to true when using built-in browser methods like navigator.credentials.create and navigator.credentials.get.

Response

Successful response

request_idstring required

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.

user_idstring required

The unique ID of the affected User.

public_key_credential_request_optionsstring required

Options used for Passkey or WebAuthn authentication.

status_codeinteger required

The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

Changes