Skip to main content
POST
Verify Registration

Authorizations

Authorization
string
header
required

Use a short-lived token obtained from the Server API's Track Action endpoint. The token is valid for 10 minutes and should be passed in the Authorization header as 'Bearer {token}'.

Body

application/json
challengeId
string
required

The ID of the passkey challenge returned when generating registration options.

registrationCredential
object
required

The registration credential object, based on https://w3c.github.io/webauthn/#dictdef-registrationresponsejson.

conditionalCreate
boolean

Whether the registration used the automatic passkey upgrade / conditional create flow.

Response

OK

isVerified
boolean
required

True if the passkey challenge was valid and the device was enrolled successfully.

accessToken
string

A new short-term token with scopes to manage authenticators (e.g. add secondary authenticators, remove authenticators, view or regenerate recovery codes). Only present if the challenge succeeded.

userAuthenticatorId
string

The ID of the user's new authenticator which is associated with the passkey credential.

userId
string

The ID of the Authsignal user associated with the passkey.

userAuthenticator
object
Example: