1. Docs
  2. API Reference
  3. OAuth hosted login: start a passkey sign-in

OAuth hosted login: start a passkey sign-in

POST/oauth/login/passkey/options

Starts a passkey sign-in on the hosted sign-in page for the Environment of client_id: returns { passkey_token, options }, the WebAuthn request options (as raw JSON for the browser's navigator.credentials.get()) for the hosted page's relying party (Canopy's, or the custom auth domain the page is on) with allowCredentials empty and userVerification: required, and the single-use token that carries the challenge for five minutes. Responds with 400 and { error } for an unknown client or an Environment with passkey sign-in off. Throttled to 30 requests per 10 minutes.

Request body

application/json

client_idstring Required

Responses

application/json

  • passkey_tokenstring*

    Single-use token carrying this sign-in's challenge, valid five minutes. Send it back with the assertion.

  • optionsany object*

    `PublicKeyCredentialRequestOptionsJSON` to pass to `navigator.credentials.get()`. `allowCredentials` is empty, so the browser offers the passkeys it holds for the relying party, and `userVerification` is `required`.

application/json

  • errorstring*

    What went wrong, for the page to show; `expired` when the session ran out

application/json

  • errorApiErrorBodyDto*

Rate limit

30 requests per 10mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address

Returned object

IdentityPasskeyOptionsResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/oauth/login/passkey/options" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "string"
  }'
Response
{
  "passkey_token": "string",
  "options": {}
}
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy