Skip to content

Start passkey registration

POST /auth/passkey/registration/options

Request Body

passwordstring

Account password. Required when the account has one and no TOTP.

totp_codestring

Current code from the authenticator app. Required when the account has TOTP enabled; the password is not accepted in its place.

Response Body

attestationstring

v1 asks for no attestation.

Example: none
Possible values:
none
authenticatorSelectionobject

residentKey: required because sign-in is usernameless, and userVerification: required so every assertion carries a second factor — which is what lets a passkey login satisfy mfa_required.

requireResidentKeyboolean
Example: true
residentKeystring
Example: required
userVerificationstring
Example: required
challengestring

base64url challenge. Single-use, stored server-side for 5 minutes.

Example: KcFagQyHSuG-Ds86-L3A-acvh4G_RfEbZCzPphaw6K4
excludeCredentialsobject[]

The user's existing credentials, so an authenticator they already enrolled refuses to register a duplicate.

idstring
transportsstring[]
typestring
Example: public-key
extensionsobject

Client extensions the library asks for. credProps lets the browser report back whether the credential really was created as discoverable.

credPropsboolean
Example: true
hintsstring[]

Always empty — v1 gives the browser no authenticator hints.

pubKeyCredParamsobject[]

Offered algorithms — Ed25519 (-8), ES256 (-7), RS256 (-257).

algnumber
Example: -7
typestring
Example: public-key
rpobject

Relying party. id is the environment's APP_URL host, so a passkey registered on one environment is never offered on another.

idstring
Example: app.truto.one
namestring
Example: Truto
timeoutnumber

Browser-side ceremony timeout in milliseconds.

Example: 60000
userobject

User handle the authenticator groups credentials under. id is the base64url-encoded Truto user id.

displayNamestring
Example: Jane Doe
idstring
Example: MTExMTExMTEtMTExMS00MTExLTgxMTEtMTExMTExMTExMTEx
namestring
Example: jane@acme.com
curl -X POST 'https://api.truto.one/auth/passkey/registration/options' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "totp_code": "your_totp_code",
  "password": "your_password"
}'
const body = {
  "totp_code": "your_totp_code",
  "password": "your_password"
};

const response = await fetch('https://api.truto.one/auth/passkey/registration/options', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
import requests

url = "https://api.truto.one/auth/passkey/registration/options"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "totp_code": "your_totp_code",
    "password": "your_password"
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())