Generate WebAuthn authentication options for an in-flight MFA challenge
/v1/identity/auth/mfa/challenge/webauthn/optionsRequest body
challenge_token *stringChallenge token returned by /v1/identity/auth/login when `requires_mfa_challenge` was true.
Code samples
curl -X POST "https://api.canopy.dev/v1/identity/auth/mfa/challenge/webauthn/options" \
-H "Content-Type: application/json" \
-d '{
"challenge_token": "string"
}'const response = await fetch("https://api.canopy.dev/v1/identity/auth/mfa/challenge/webauthn/options", {
method: "POST",
headers: {
"Content-Type": "application/json"
},
body: JSON.stringify({
"challenge_token": "string"
}),
});
const data = await response.json();import requests
response = requests.post(
"https://api.canopy.dev/v1/identity/auth/mfa/challenge/webauthn/options",
headers={
"Content-Type": "application/json"
},
json={
"challenge_token": "string",
},
)
data = response.json()package main
import (
"bytes"
"encoding/json"
"net/http"
)
func main() {
payload := map[string]interface{}{
"challenge_token": "string",
}
body, _ := json.Marshal(payload)
req, _ := http.NewRequest("POST", "https://api.canopy.dev/v1/identity/auth/mfa/challenge/webauthn/options", bytes.NewBuffer(body))
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
}Responses
200 Returns `PublicKeyCredentialRequestOptions` for `navigator.credentials.get()`. The challenge row's WebAuthn nonce is persisted server-side and consumed by /verify.
{}application/json
any object 401 Challenge token is missing, expired, already consumed, or locked after too many failed attempts