1. Docs
  2. API Reference
  3. OAuth hosted login: verify a WebAuthn assertion

OAuth hosted login: verify a WebAuthn assertion

POST/oauth/mfa/webauthn/verify

Step 2 of the hosted WebAuthn MFA factor: verifies the browser assertion against the challenge_token. On success it optionally issues a trusted-device cookie, stamps the hosted-session cookie, mints an authorization code, and returns { redirect_to } as JSON for the fetch-driven ceremony to navigate to; on failure it returns 400 with { error }. Throttled to 10 requests per minute.

Request body

application/json

challenge_tokenstring Required
responseobject Required

The browser-produced AuthenticationResponseJSON assertion.

client_idstring Required
redirect_uristring Required
response_typestring Required
scopestring Required
statestring Optional
code_challengestring Required
code_challenge_methodstring Required
noncestring Optional
remember_deviceboolean Optional

Remember this browser so the next hosted sign-in from it skips the second factor. Honoured only when the Environment's `mfa_trusted_device_days` is above 0 (the default is 0, which disables remembering); the trust rides in the httpOnly `ca_identity_mfa_trusted_device` cookie on Canopy's domain.

Responses

application/json

  • redirect_tostring*

    Where the hosted page navigates next

application/json

  • errorstring*

    What went wrong, for the page to show; `expired` when the session ran out

application/json

  • errorApiErrorBodyDto*

Rate limit

10 requests per 1mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address

Returned object

OAuthRedirectToResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/oauth/mfa/webauthn/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_token": "string",
    "response": {},
    "client_id": "string",
    "redirect_uri": "string",
    "response_type": "string",
    "scope": "string",
    "state": "string",
    "code_challenge": "string",
    "code_challenge_method": "string",
    "nonce": "string",
    "remember_device": false
  }'
Response
{
  "redirect_to": "string"
}
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy