# Start passwordless passkey sign-in

> Source: https://truto.one/docs/api-reference/admin/passkeys/authentication-options/

`POST /auth/passkey/authentication/options`

Resource: **Passkeys**

## Request body

- **`cf_token`** _(string)_
  Cloudflare Turnstile token from the sign-in page.

## Response body

- **`options`** _(object, required)_
  A bare `PublicKeyCredentialRequestOptionsJSON` — pass it straight to `navigator.credentials.get({ publicKey })`. Note `rpId` is flat here, unlike the nested `rp` object on registration options.
  - **`rpId`** _(string)_
    The environment's `APP_URL` host.
  - **`challenge`** _(string)_
    base64url challenge. Single-use, stored server-side for 5 minutes under `handle`.
  - **`allowCredentials`** _(array<object>)_
    Always empty — sign-in is usernameless, so the browser offers whichever discoverable credential it holds for this `rpId`. Naming credentials here would leak which accounts exist.
  - **`timeout`** _(number)_
  - **`userVerification`** _(string)_
    Allowed: `required`
- **`handle`** _(string)_
  Opaque key the challenge is stored under. Echo it on `authentication/verify`.

## Code examples

### curl

```bash
curl -X POST 'https://api.truto.one/auth/passkey/authentication/options' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "cf_token": "your_cf_token"
}'
```

### JavaScript

```javascript
const body = {
  "cf_token": "your_cf_token"
};

const response = await fetch('https://api.truto.one/auth/passkey/authentication/options', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

url = "https://api.truto.one/auth/passkey/authentication/options"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "cf_token": "your_cf_token"
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())
```