1. Docs
  2. API Reference
  3. Get passkey assertion options for the sign-in challenge

Get passkey assertion options for the sign-in challenge

POST/v1/auth/mfa/challenge/webauthn/options

Returns the navigator.credentials.get() assertion options for the pending challenge_token, under Canopy's relying party and limited to the administrator's passkeys bound to it; the nonce is kept on the challenge for the verify step. 401 when the token is invalid, 400 when no passkey can answer. Rate-limited to 10 requests per minute.

Request body

application/json

challenge_tokenstring Required

Challenge token returned by /v1/identity/auth/login when `requires_mfa_challenge` was true.

Responses

application/json

  • dataMfaChallengeWebAuthnOptionsResponseDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

application/json

  • errorApiErrorBodyDto*

Rate limit

10 requests per 1mPer caller: the signed-in user for a bearer token; for an API key, the key and the end user's address when a backend forwards it, otherwise the client address

Returned object

MfaChallengeWebAuthnOptionsResponseDtoView all properties on this resource
Request
curl -X POST "https://auth.canopy-io.com/v1/auth/mfa/challenge/webauthn/options" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge_token": "string"
  }'
Response
{
  "data": {
    "challenge": "string",
    "timeout": 0,
    "rpId": "string",
    "allowCredentials": {},
    "userVerification": {},
    "hints": {},
    "extensions": {}
  }
}
 Related endpoints
POSTAnswer the sign-in challenge with an authenticator app code
POSTAnswer the sign-in challenge with a recovery code
POSTAnswer the sign-in challenge with a passkey
POSTEnroll an authenticator app to complete a sign-in that required one
POSTGet passkey creation options to complete a sign-in that required a factor
POSTEnroll a passkey to complete a sign-in that required a factor
 Was this page helpful?

Tell us how we can improve this guide.

Canopy