Complete passkey registration
Verifies the WebAuthn attestation against the single-use, expiring challenge and stores the public key + credential ID (public material only). Rejects a second credential without a valid existing-credential approval, a replayed challenge, or a duplicated credential ID.
Verifies the WebAuthn attestation against the single-use, expiring challenge and stores the public key + credential ID (public material only). Rejects a second credential without a valid existing-credential approval, a replayed challenge, or a duplicated credential ID.
Authorization
cookieAuth JWT access token set by /auth/google/callback or /auth/refresh
In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/credentials/register/finish" \ -H "Content-Type: application/json" \ -d '{ "registrationId": "cb67e1cd-0e53-4115-9a51-243e5b471e8b", "credential": {} }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "type": "secp256r1", "credentialId": "string", "publicKey": "string", "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z"}Begin credential authentication POST
Previous Page
Begin passkey registration POST
Returns WebAuthn registration options. When the account already has a credential, `isAdditional` is true and an `approval` challenge is included — the client must assert with an existing credential to authorize adding the new one (existing-credential approval rule).