Sign in
Users

Create Challenge

Mints the challenge a browser needs to run a WebAuthn ceremony against the authenticated user's own passkeys. A registration challenge enrolls a new passkey; a deletion challenge is bound to the one passkey named by passkey_id and proves the user still holds it. Challenges are single-use and expire 5 minutes after they are issued, so send a fresh Idempotency-Key per ceremony — a replayed key returns the original challenge, which may already have expired. Requires a user session.

post/users/me/passkeys/challenge

Headers

Idempotency-Keystring
Example:d9105228-4a08-46b1-8b91-42fed586d383

A unique key that makes this request safe to retry. See Idempotent requests.

Request body

challenge_type'registration' | 'deletion' required

The ceremony this challenge is for.

passkey_idstring

The passkey the ceremony targets, prefixed wcred_. Required when challenge_type is deletion, ignored otherwise.

Example request

{
  "challenge_type": "registration",
  "passkey_id": "wcred_xxxxxxxxxxxxxx"
}

Response

challenge minted

challengestring required

The challenge to pass to the WebAuthn ceremony, base64url-encoded without padding.

Example response

{
  "challenge": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Changes

Changed in 3 of the 42 revisions of this API.6

  • ae20b30817de1See the full diff
    • ○

      added the non-success response with the status 409

      response-non-success-status-added

  • f1020c3ecda44See the full diff
    • ○

      added the optional property error/code to the response with the 400 status

      response-optional-property-added

    • ○

      added the optional property error/code to the response with the 401 status

      response-optional-property-added

    • ○

      added the optional property error/code to the response with the 403 status

      response-optional-property-added

    • ○

      added the optional property error/code to the response with the 404 status

      response-optional-property-added

    This revision also has 9 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 099fdc3be4221See the full diff
    • ○

      endpoint added

      endpoint-added

    This revision also has 4 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Of the 42 revisions, 1 has no diff computed.