Skip to content
Authrim

Start Direct Auth passkey signup.

POST
/api/v1/auth/direct/passkey/signup/start
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/v1/auth/direct/passkey/signup/start \
  --header 'Content-Type: application/json' \
  --data '{ "client_id": "client_123", "email": "user@example.com", "display_name": "Example User", "code_challenge": "rfc7636-code-challenge", "code_challenge_method": "S256", "channel": "browser" }'

Creates WebAuthn registration options for Direct Auth signup after validating client, channel, and origin. Email is optional and is not used for discoverable Passkey lookup.

Request Body required

Section titled “Request Body required ”
Media type application/json

Email is optional and is retained only as profile data when supplied.

object
client_id
required
string
email
string format: email
display_name
string
code_challenge
required
string
code_challenge_method
required
string
Allowed values: S256
channel
required
string
Allowed values: browser native
scope
string
authenticator_type
string
Allowed values: platform cross-platform any
resident_key
string
Allowed values: required preferred discouraged
user_verification

Accepted for compatibility and ignored. User verification is always required for passkey registration.

string
Allowed values: required preferred discouraged
custom_fields
object
key
additional properties
provisioning_token

Internal Login UI continuation token returned by a previous 202 response.

string
/^[A-Za-z0-9_-]{43}$/
resume_user_id

Internal Login UI continuation value paired with provisioning_token.

string
invite_token

Tenant invitation token. Checked before the account is created (active, of this tenant, and for the email it names, if any) and one use reserved for this signup; its role or organization is assigned to the new account when signup/finish registers the passkey.

string
>= 1 characters
invitation_email_proof

Proof of the invited email from /api/v1/invitations/email-verification/verify, needed when the tenant requires the email an invitation names to be proved.

string
Example 
{
  "client_id": "client_123",
  "email": "user@example.com",
  "display_name": "Example User",
  "code_challenge": "rfc7636-code-challenge",
  "code_challenge_method": "S256",
  "channel": "browser"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Successful JSON response.

Media type application/json
object
challenge_id
required
string
options
required

WebAuthn options generated by @simplewebauthn/server.

object
key
additional properties
Example 
{
  "challenge_id": "challenge_123",
  "options": {
    "challenge": "challenge",
    "rpId": "auth.example.com",
    "allowCredentials": [],
    "userVerification": "required"
  }
}

202

Section titled “202 ”

Account creation is durable but its active Lookup route is not ready yet.

Media type application/json
object
status
required
string
Allowed value: provisioning
provisioning_token
required
string
/^[A-Za-z0-9_-]{43}$/
status_endpoint
required
string
Allowed value: /api/v1/auth/account-provisioning/status
retry_after_ms
required
integer
>= 250 <= 2000
expires_in
required
integer
>= 1 <= 600
resume_user_id

Present for passkey signup only. The Login UI sends this continuation value back with the provisioning token so a retried request reuses the same account candidate.

string
key
additional properties
Example 
{
  "status": "provisioning",
  "status_endpoint": "/api/v1/auth/account-provisioning/status"
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}