---
title: "Login Webauthn Begin"
method: POST
path: "/auth/mfa/login/webauthn/begin"
tags: ["Auth"]
---

# Login Webauthn Begin

`POST /auth/mfa/login/webauthn/begin`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/auth/mfa/login/webauthn/begin`
- Auth: none declared

Generate WebAuthn assertion options for the second login step.

Unauthenticated — the ``mfa_challenge_token`` from /login is the
proof that step one (password) succeeded.

## Headers

- `API-Version` '1'

## Request body

- WebAuthnLoginBeginRequest: POST body for /auth/mfa/login/webauthn/begin. The ``mfa_challenge_token`` proves the password step has already succeeded; we lean on it instead of requiring an authenticated session (the whole point of this step is that the user does not yet have one).
  - `mfa_challenge_token` string, required

## Response `200`

Successful Response

- WebAuthnLoginBeginResponse: Body returned by /auth/mfa/login/webauthn/begin. ``options`` is the JSON form of ``PublicKeyCredentialRequestOptions``.
  - `options` object, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/totalparks/apis/total-parks-public-api.md) · [All operations](https://skmtc.dev/totalparks/apis/total-parks-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/totalparks/apis/total-parks-public-api/revisions/dcb4c822e2c6?raw)