Passkeys

3 endpoints

Passwordless WebAuthn sign-in with device biometrics.

passkeys.read

passkeys.write

List and revoke WebAuthn passkey credentials for directory users.

Authenticate with your organization API key. Include subOrgId as a query parameter or in the request body when using an org-wide key. Organization-scoped keys automatically target their organization.

POST

/v1/auth/passkey/register

Enroll a passkey for an existing directory user. Call with action: "options" then action: "verify" after navigator.credentials.create(). Requires passkeys.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Request Body

Param	Type	Required	Description
action	string	Yes	Ceremony step: options or verify
userId	string	Yes	Directory user ID
challengeId	string	No	Passkey challenge ID from the options response
credential	object	No	WebAuthn credential from navigator.credentials.create() or get()
deviceName	string	No	Optional friendly name for the passkey
subOrgId	string	Yes	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "options": { /* WebAuthn create options */ }, "challengeId": "..." }

GET

/v1/webauthn/credentials

List passkey credentials for a directory user. Requires passkeys.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.
userId	string	Yes	Directory user ID

Response — 200

{ "credentials": [ /* passkey records */ ] }

DELETE

/v1/webauthn/credentials/{credentialId}

Revoke a passkey credential for a directory user. Requires passkeys.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one organization.

Response — 200

{ "success": true }