Check browser cross-origin access.

OPTIONS

/api/v1/auth/direct/passkey/login/start

Code sample: Shell / cURL

curl --request OPTIONS \
  --url https://auth.example.com/api/v1/auth/direct/passkey/login/start

Responds with the configured CORS policy. This does not authenticate a browser, validate a credential, or authorize the corresponding operation. In the AWS SAML profile, this endpoint is unavailable when login is disabled.

Responses

204

Browser preflight response. Access-Control-Allow-Origin is present only for a configured allowed origin; the remaining headers alone do not grant browser access.

Headers

Access-Control-Allow-Origin

string format: uri

Access-Control-Allow-Credentials

string

Allowed value: true

Access-Control-Allow-Methods

string

Access-Control-Allow-Headers

string

Access-Control-Max-Age

string

Allowed value: 86400

404

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}