AuthEndpoints
Changelog
Examples

Sign in with a passkey

Passwordless login for a confirmed account on the cookie facade.

Sign in an existing, confirmed account with WebAuthn. Unconfirmed register and check-email stay on Register a confirmed account.

Facade defaults: passkeys under /account/passkeys. Default completer is IdentityPasskeySignInCompleter. Cookie query flags follow Identity Login, not LoginCookie.

Steps

  1. Call GET /identity/csrfToken and send RequestVerificationToken on the POSTs below.
  2. POST /account/passkeys/requestOptions (optional query username / email). CSRF required.
  3. Run navigator.credentials.get(…) with the returned options. If the user cancels, stop. Do not call login.
  4. POST /account/passkeys/login?useCookies=true with body { "credentialJson" } and CSRF. Use useSessionCookies=true for a session cookie, or omit both flags for an Identity bearer AccessTokenResponse instead of a cookie.
  5. On success with cookie flags, enter the app with credentials: "include".
  6. Unconfirmed or locked-out accounts: 401 Invalid credentials (no session).

Related

Complete step-up (ReAuth)

Prove identity before a CSRF-protected manage or host action.

Overview

Compose Identity management, sign-in stacks, and passkeys on the prefixes your host needs.