1. Docs
  2. API Reference
  3. Generate WebAuthn authentication options for an in-flight MFA challenge

Generate WebAuthn authentication options for an in-flight MFA challenge

POST/v1/identity/auth/mfa/challenge/webauthn/options

Request body

  • challenge_tokenstring*

    Challenge token returned by /v1/identity/auth/login when `requires_mfa_challenge` was true.

Code samples

cURLJavaScriptPythonGo
curl -X POST "https://api.canopy.dev/v1/identity/auth/mfa/challenge/webauthn/options" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_token": "string"
  }'

Responses

200 Returns `PublicKeyCredentialRequestOptions` for `navigator.credentials.get()`. The challenge row's WebAuthn nonce is persisted server-side and consumed by /verify.
{}

application/json

any object
401 Challenge token is missing, expired, already consumed, or locked after too many failed attempts
On this page

Related endpoints

POSTSubmit a TOTP code to satisfy an in-flight MFA challenge
POSTRedeem a single-use recovery code to satisfy an in-flight MFA challenge
POSTSubmit a WebAuthn assertion to satisfy an in-flight MFA challenge
POSTTrigger an email OTP for an in-flight MFA challenge
POSTSubmit an email OTP to satisfy an in-flight MFA challenge