API : Passkey Authenticate Options

Introduction

First step of a passkey login. Returns the challenge and options to pass to the browser's WebAuthn API (e.g. @simplewebauthn/browser's startAuthentication()). No username is accepted and no allowCredentials list is returned - the browser's own discoverable-credential picker decides which passkey to use, so this endpoint reveals nothing about which accounts exist. Unauthenticated.

See webauthn for the relying-party model and webauthn-authenticate for the step that follows.

Request

URL	https://api.telecomx.dk/auth/webauthn/authenticate/options
Method	POST
Header	Origin	String	Required. Decides the relying party - see webauthn
Body	none

Response

Property	Type	Description
challengeId	String	Opaque id, 32 random bytes base64url encoded. Pass this back unchanged to webauthn-authenticate
options	Object	`PublicKeyCredentialRequestOptions` - passed directly to the browser's WebAuthn API. Built with `rpId` set to the resolved relying party and `userVerification: “required”`; carries no `allowCredentials`

Example

{
  challengeId: 'Zm9vYmFyYmF6cXV4Y29ycmVjdGhvcnNlYmF0dGVyeXN0YXBsZQ',
  options: {
    challenge: 'wZjb3JyZWN0IGhvcnNlIGJhdHRlcnkgc3RhcGxl',
    rpId: 'telecomx.dk',
    userVerification: 'required',
    timeout: 60000
  }
}

Errors

Error code	Message	Description
401	origin_invalid	`Origin` header is missing, not https (outside development), or not a known/active portal
429	(empty)	Rate limit exceeded on the `login` scope, keyed by the caller's IP

WIKI

Table of Contents