Passkey
WebAuthn / FIDO2 passkey registration and authentication endpoints.
Passkeys work in two two-step "ceremonies":
| Ceremony | Step 1 — get a challenge | Step 2 — send proof |
|---|---|---|
| Registration (set up a new passkey) | POST /api2/passkey/registration_options |
POST /api2/passkey/registration |
| Authentication (sign in with an existing passkey) | POST /api2/passkey/authentication_options |
POST /api2/passkey/authentication |
Registration endpoints require a signed-in guest (Bearer access token). Authentication endpoints are unauthenticated by design — the guest has not signed in yet. Every endpoint requires the client query parameter (Doorkeeper application UID for the brand, scope Advance Auth).
Challenges are stored server-side (Redis, keyed by user + business) with a 5-minute TTL. If a ceremony takes longer than that, restart it from the corresponding *_options call.