OAuth hosted login: WebAuthn enrollment options

POST

/oauth/mfa/webauthn/enroll/options

Step 1 of hosted WebAuthn MFA enrollment: returns the attestation options (and a fresh enrollment_token) as JSON for the browser's navigator.credentials.create(). The subject is derived from the enrollment_token minted by the prior authorize step. Responds with 400 and { error: "expired" } when that token is invalid or expired. Throttled to 5 requests per minute.

Request body

application/json

enrollment_tokenstring Required

Responses

application/json

enrollment_tokenstring*
Opaque short-lived (5 min) sealed token carrying the WebAuthn challenge nonce. Must be returned to /mfa/webauthn/enroll/verify exactly.
optionsany object*
`PublicKeyCredentialCreationOptions` JSON to pass to `navigator.credentials.create()`. Shape per the WebAuthn Level 2 spec; key fields: `rp`, `user`, `challenge`, `pubKeyCredParams`, `excludeCredentials`, `authenticatorSelection`.

application/json

errorstring*
What went wrong, for the page to show; `expired` when the session ran out

application/json

errorApiErrorBodyDto*

Rate limit

5 requests per 1mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address

Returned object

MfaWebAuthnEnrollOptionsResponseDtoView all properties on this resource

Request

curl -X POST "https://auth.canopy-io.com/oauth/mfa/webauthn/enroll/options" \
  -H "Content-Type: application/json" \
  -d '{
    "enrollment_token": "string"
  }'

Response

{
  "enrollment_token": "string",
  "options": {}
}

Was this page helpful?

Tell us how we can improve this guide.