Get Passkey Sign-In Options

Looks up the guest by identifier (email or phone) and returns the WebAuthn PublicKeyCredentialRequestOptions plus a one-time session_token needed to complete sign-in via POST /api2/passkey/authentication.

Use this endpoint to check whether a guest has a registered passkey: a 200 response means a passkey is available — prompt the user for biometric verification. A 422 passkey_authentication_not_available response means the guest has no passkey — fall back to password, OTP, or social sign-in. This is the expected common path, not an error.

This endpoint is unauthenticated. client is sent as a query parameter.

For a full integration guide, see Passkey Authentication.

Query Parameters

client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for authentication. The OAuth application must have the Advance Auth scope enabled.

Body

required

application/json

Identifier of the guest attempting to sign in.

identifier
Type: string
required

The guest's email address or phone number (with country code) registered for this business. Used to resolve the account and look up its registered passkeys.

Responses

application/json
application/json
application/json
application/json
application/json

post/api2/passkey/authentication_options

curl 'https://SERVER_NAME_GOES_HERE/api2/passkey/authentication_options?client=CLIENT_ID_GOES_HERE' \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "identifier": "test@example.com"
}'

Show Schema

{
  "data": {
    "challenge": "CHALLENGE_GOES_HERE",
    "rpId": "loyalty.example.com",
    "allowCredentials": [
      {
        "type": "public-key",
        "id": "ID_GOES_HERE"
      }
    ],
    "session_token": "SESSION_TOKEN_GOES_HERE"
  }
}

WebAuthn assertion options and a one-time session_token returned. The challenge expires after 5 minutes.