---
title: "Authenticatestart"
method: POST
path: "/v1/webauthn/authenticate/start"
tags: ["Webauthn"]
---

# Authenticatestart

`POST /v1/webauthn/authenticate/start`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/webauthn/authenticate/start`
- Auth: HTTP basic

Initiate the authentication of a Passkey or WebAuthn registration. 

To optimize for Passkeys, set the `return_passkey_credential_options` field to `true`.

After calling this endpoint, the browser will need to call [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) with the data from `public_key_credential_request_options` passed to the [navigator.credentials.get()](https://www.w3.org/TR/webauthn-2/#sctn-getAssertion) request via the public key argument.

When using built-in browser methods like `navigator.credentials.get()`, set the `use_base64_url_encoding` option to `true`.

See our [WebAuthn setup guide](https://stytch.com/docs/guides/webauthn/api) for additional usage instructions and example code.

## Request body

- ApiWebauthnV1AuthenticateStartRequest: Request type
  - `domain` string, required: The domain for Passkeys or WebAuthn. Defaults to `window.location.hostname`.
  - `user_id` string: The `user_id` of an active user the Passkey or WebAuthn registration should be tied to. You may use an `external_id` here if one is set for the user.
  - `return_passkey_credential_options` boolean: If true, the `public_key_credential_creation_options` returned will be optimized for Passkeys with `userVerification` set to `"preferred"`.
  - `use_base64_url_encoding` boolean: If true, values in the `public_key_credential_creation_options` will be base64 URL encoded. Set this option to true when using built-in browser methods like `navigator.credentials.create` and `navigator.credentials.get`.

## Response `200`

Successful response

- ApiWebauthnV1AuthenticateStartResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `user_id` string, required: The unique ID of the affected User.
  - `public_key_credential_request_options` string, required: Options used for Passkey or WebAuthn authentication.
  - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2026-01-21** `3e4c16dac486`: 1 info
  - added the new optional request property `use_base64_url_encoding`
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`
- **2025-09-17** `864b9f438ac0`: 2 breaking
  - the `return_passkey_credential_options` request property type changed from `string` to `boolean`
  - the `status_code` response's property type changed from `string` to `integer`, and format from no format to `int32` for status `200`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/webauthn/authenticate/start/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)