Get Passkey Registration Options

Returns the WebAuthn PublicKeyCredentialCreationOptions needed to register a passkey for the signed-in guest. Guest Identity Service generates a one-time challenge that expires after 5 minutes and is consumed by POST /api2/passkey/registration.

Pass the returned data object directly into navigator.credentials.create() on web, or the equivalent platform passkey API on iOS / Android.

Authentication: Requires a valid Bearer access token. client is sent as a query parameter. This endpoint takes no request body.

For a full integration guide, see Passkey Authentication.

Query Parameters

client
Type: string
required

OAuth client ID provided by the business. Required to identify the client application for authentication. The OAuth application must have the Advance Auth scope enabled.

Headers

Authorization
Type: string
required

Used to authorize the request with access_token. It should be supplied as Bearer ACCESS_TOKEN_GOES_HERE.

Responses

application/json
application/json
application/json
application/json
application/json
application/json

post/api2/passkey/registration_options

curl 'https://SERVER_NAME_GOES_HERE/api2/passkey/registration_options?client=CLIENT_ID_GOES_HERE' \
  --request POST \
  --header 'Authorization: '

Show Schema

{
  "data": {
    "challenge": "CHALLENGE_GOES_HERE",
    "rp": {
      "id": "loyalty.example.com",
      "name": "Test"
    },
    "user": {
      "id": "ID_GOES_HERE",
      "name": "test@example.com",
      "displayName": "test@example.com"
    },
    "pubKeyCredParams": [
      {
        "type": "public-key",
        "alg": -7
      }
    ]
  }
}

Registration options generated successfully. The challenge expires after 5 minutes.