1. Docs
  2. API Reference
  3. OAuth hosted login: WebAuthn authentication options

OAuth hosted login: WebAuthn authentication options

POST/oauth/mfa/webauthn/options

Step 1 of the hosted WebAuthn MFA factor: returns the assertion options (as raw JSON for the browser's navigator.credentials.get()) for the active challenge_token. Responds with 400 and { error } when the challenge is invalid or expired. Throttled to 10 requests per minute.

Request body

application/json

challenge_tokenstring Required

Responses

application/json

  • challengestring*

    Challenge, base64url

  • timeoutnumber

    Milliseconds the ceremony may take

  • rpIdstring

    Relying party id

  • allowCredentialsOAuthWebAuthnCredentialDescriptorDto[]

    The identity's registered passkeys

  • userVerificationstring

application/json

  • errorstring*

    What went wrong, for the page to show; `expired` when the session ran out

application/json

  • errorApiErrorBodyDto*

Rate limit

10 requests per 1mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address

Returned object

OAuthWebAuthnRequestOptionsResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/oauth/mfa/webauthn/options" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_token": "string"
  }'
Response
{
  "challenge": "string",
  "timeout": 0,
  "rpId": "string",
  "allowCredentials": [
    {
      "id": "string",
      "type": "public-key",
      "transports": [
        "string"
      ]
    }
  ],
  "userVerification": "preferred"
}
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy