Complete Passkey Sign-In

Completes the passkey sign-in flow by verifying the WebAuthn assertion from navigator.credentials.get() against the stored challenge. On success, issues JWT access and refresh tokens — the same token format as all other sign-in methods, so no downstream changes are needed.

The session_token must be the same one returned by authentication_options for the same business.

This endpoint is unauthenticated — the session_token carries the session state. client is sent as a query parameter.

For a full integration guide, see Passkey Authentication.

Query Parameters

client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for authentication. The OAuth application must have the Advance Auth scope enabled.

Body

required

application/json

WebAuthn assertion payload returned by navigator.credentials.get() (or the equivalent platform API), along with the session_token issued by /api2/passkey/authentication_options.

credential
Type: object
required

The WebAuthn PublicKeyCredential returned by navigator.credentials.get(), (or the equivalent platform API), serialized to JSON for submission to Guest Identity Service.
session_token
Type: string
required

Single-use token returned by /api2/passkey/authentication_options. Links this request to the authentication session for the guest and business. Expires after 5 minutes.

Responses

application/json
application/json
application/json
application/json
application/json
application/json

post/api2/passkey/authentication

curl 'https://SERVER_NAME_GOES_HERE/api2/passkey/authentication?client=CLIENT_ID_GOES_HERE' \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "session_token": "SESSION_TOKEN_GOES_HERE",
  "credential": {
    "id": "ID_GOES_HERE",
    "type": "public-key",
    "response": {
      "clientDataJSON": "CLIENT_DATA_JSON_GOES_HERE",
      "authenticatorData": "AUTHENTICATOR_DATA_GOES_HERE",
      "signature": "SIGNATURE_GOES_HERE",
      "userHandle": null
    }
  }
}'

Show Schema

{
  "data": {
    "access_token": "ACCESS_TOKEN_GOES_HERE",
    "refresh_token": "REFRESH_TOKEN_GOES_HERE",
    "expires_in": 7200
  }
}

Passkey verified. JWT access and refresh tokens issued.