Skip to content

Finish passkey registration

POST /auth/passkey/registration/verify

Request Body

responseobject
required·

The PublicKeyCredential returned by navigator.credentials.create(), JSON-serialized (base64url). Extra fields the browser adds (clientExtensionResults, authenticatorAttachment) are accepted and ignored.

responseobject
required
3 properties
attestationObjectstring

base64url. Max 64 KB.

clientDataJSONstring

base64url. Max 64 KB.

transportsstring[]

Transport hints reported by the authenticator. Max 16 entries of 64 characters each.

Example: ["internal","hybrid"]
idstring

base64url credential ID. Max 64 KB.

rawIdstring

base64url credential ID. Max 64 KB.

typestring

Always public-key. Max 64 characters.

Example: public-key
namestring

Optional label for the credential. Trimmed; blank becomes null.

Example: MacBook Touch ID

Response Body

passkeyobject
required·

A registered WebAuthn credential, sanitized for display. Credential material (credential_id, public_key) is never returned.

backup_stateboolean

Whether the credential is currently synced into a backup (the WebAuthn BS flag). Refreshed on every sign-in.

Example: true
created_atstring · date-time

ISO-8601 UTC timestamp of registration.

Example: 2026-07-01T11:03:20.000Z
device_typestring

multiDevice for a synced passkey (iCloud Keychain, Google Password Manager); singleDevice for a device-bound one (a security key, or a platform authenticator that does not sync).

Example: multiDevice
Possible values:
singleDevicemultiDevicenull
idstring · uuid

The unique ID of the passkey. Use this to rename or delete it.

Example: 1ba1f401-7183-47c5-9e39-e8e257e3c795
last_used_atstring · date-time

ISO-8601 UTC timestamp of the last successful sign-in with this passkey; null if it has never been used.

Example: 2026-07-23T09:12:44.000Z
namestring

User-supplied label, or null when the passkey was registered without one.

Example: MacBook Touch ID
successboolean
Example: true
curl -X POST 'https://api.truto.one/auth/passkey/registration/verify' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "response": {},
  "name": "MacBook Touch ID"
}'
const body = {
  "response": {},
  "name": "MacBook Touch ID"
};

const response = await fetch('https://api.truto.one/auth/passkey/registration/verify', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
import requests

url = "https://api.truto.one/auth/passkey/registration/verify"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "response": {},
    "name": "MacBook Touch ID"
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())