Skip to content
Tilecast Docs

passkeyLogin

POST
/api/v1/auth/passkey/login
curl --request POST \
  --url https://example.com/api/v1/auth/passkey/login \
  --header 'Content-Type: application/json' \
  --header 'X-MFA-Challenge: example' \
  --data '{ "id": "example", "rawId": "example", "type": "public-key", "authenticatorAttachment": "platform", "clientExtensionResults": {}, "response": { "clientDataJSON": "example", "authenticatorData": "example", "signature": "example", "userHandle": "example" } }'

Posts the raw WebAuthn assertion. A verified passkey satisfies multi-factor authentication on its own.

Parameters

Section titled “ Parameters ”

Header Parameters

Section titled “Header Parameters”
X-MFA-Challenge
required
string

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

A PublicKeyCredential from navigator.credentials.get(), serialized with base64url binary fields.

object
id
required
string
rawId
required

Base64url

string
type
required
string
Allowed values: public-key
authenticatorAttachment
string
Allowed values: platform cross-platform
clientExtensionResults
object
key
additional properties
any
response
required
object
clientDataJSON
required

Base64url

string
authenticatorData
required

Base64url

string
signature
required

Base64url

string
userHandle

Base64url

string

Responses

Section titled “ Responses ”

200

Section titled “200”

Signed in

Media typeapplication/json
object
data
required
object
user
required
object
id
required
string format: uuid
name
required
string
username
required
string
role
required

Role key. The built-in roles are owner, administrator, editor, contributor, and viewer. Custom role keys start with “custom.”. Decide authorization from the capabilities the server reports, not from the role key.

string
/^[a-z][a-z0-9.-]{1,63}$/
active
required
boolean
createdAt
required
string format: date-time
lastLoginAt
string format: date-time
capabilities

Effective capabilities of the signed-in user’s role.

Array<string>
csrfToken
required
string
authMethod
required
string
Allowed values: password totp passkey recovery_code demo
mfaEnrollmentRequired
required
boolean
Example
{
  "data": {
    "user": {
      "role": "owner"
    },
    "authMethod": "password"
  }
}

401

Section titled “401”

The passkey could not be verified