Skip to content
Authrim

Finish Direct Auth passkey login.

POST
/api/v1/auth/direct/passkey/login/finish
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/v1/auth/direct/passkey/login/finish \
  --header 'Content-Type: application/json' \
  --data '{ "challenge_id": "challenge_123", "credential": { "id": "credential-id", "type": "public-key", "response": {} }, "code_verifier": "rfc7636-code-verifier", "channel": "browser" }'

Verifies the passkey authentication response and returns a short-lived Direct Auth artifact for session redemption or token exchange.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
challenge_id
required
string
credential
required

WebAuthn credential response from the browser.

object
key
additional properties
code_verifier
required
string
channel
required
string
Allowed values: browser native
Example 
{
  "challenge_id": "challenge_123",
  "credential": {
    "id": "credential-id",
    "type": "public-key",
    "response": {}
  },
  "code_verifier": "rfc7636-code-verifier",
  "channel": "browser"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Successful JSON response.

Media type application/json
object
direct_auth_artifact
required
string
expires_in
required
integer
is_new_user
boolean
Example 
{
  "direct_auth_artifact": "direct_auth_code_123",
  "expires_in": 60,
  "is_new_user": true
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}