Users

Create Challenge

Changed on

Mints the challenge a browser needs to run a WebAuthn ceremony against the authenticated user's own passkeys. A registration challenge enrolls a new passkey; a deletion challenge is bound to the one passkey named by passkey_id and proves the user still holds it. Challenges are single-use and expire 5 minutes after they are issued, so send a fresh Idempotency-Key per ceremony — a replayed key returns the original challenge, which may already have expired. Requires a user session.

post/users/me/passkeys/challenge

Request

  • Base URL: https://api.whop.com/api/v1
  • URL: https://api.whop.com/api/v1/users/me/passkeys/challenge
  • Auth: HTTP bearer

Headers

Idempotency-Keystring
Example:d9105228-4a08-46b1-8b91-42fed586d383

A unique key that makes this request safe to retry. See Idempotent requests.

Request body

challenge_type'registration' | 'deletion' required

The ceremony this challenge is for.

passkey_idstring

The passkey the ceremony targets, prefixed wcred_. Required when challenge_type is deletion, ignored otherwise.

Example request

{
  "challenge_type": "registration",
  "passkey_id": "wcred_xxxxxxxxxxxxxx"
}

Response

challenge minted

challengestring required

The challenge to pass to the WebAuthn ceremony, base64url-encoded without padding.

Example response

{
  "challenge": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Changes

  • ae20b30817deRevision changes
    • info

      added the non-success response with the status

  • f1020c3ecda4Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status