1. Docs
  2. API Reference
  3. OAuth hosted login: sign in with a passkey

OAuth hosted login: sign in with a passkey

POST/oauth/login/passkey/verify

Completes a passkey sign-in on the hosted sign-in page: a form post carrying the authorization request, the passkey_token and the assertion (response, the JSON navigator.credentials.get() produced). Verifies the passkey as the Direct API does, then runs the sign-in gate a password runs (the organization the session starts in, its policy, which may refuse the passkey method) and mints the authorization code with amr ["hwk", "mfa"], redirecting to redirect_uri. The passkey counts as the second factor, so no challenge follows. A refused passkey re-renders the sign-in page with the reason. Throttled to 10 requests per 10 minutes.

Request body

application/json

client_idstring Required
redirect_uristring Required
response_typestring Required
scopestring Required
statestring Optional
code_challengestring Required
code_challenge_methodstring Required
noncestring Optional
organizationstring Optional
passkey_tokenstring Required

The `passkey_token` from `POST /oauth/login/passkey/options`.

responsestring Required

The PublicKeyCredential JSON `navigator.credentials.get()` produced, as a string (the page posts it as a form field).

Responses

text/html

string

A redirect to the client's `redirect_uri`: with `code` and `state` once the sign-in clears, or with `error` and `state` when a verified client's request is refused (an unsupported `response_type`, `code_challenge_method` or scope, a malformed `organization`, or an organization the person does not belong to)

application/json

  • errorApiErrorBodyDto*

text/html

string

application/json

  • errorApiErrorBodyDto*

Rate limit

10 requests per 10mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address
Request
curl -X POST "https://auth.canopy-io.com/oauth/login/passkey/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "string",
    "redirect_uri": "string",
    "response_type": "string",
    "scope": "string",
    "state": "string",
    "code_challenge": "string",
    "code_challenge_method": "string",
    "nonce": "string",
    "organization": "string",
    "passkey_token": "string",
    "response": "string"
  }'
Response
Content-Type: text/html

<!doctype html>
<html lang="en">
  <head>…</head>
  <body>
    <!-- The hosted page: its form, any error, and the Environment's branding -->
  </body>
</html>
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy