# Finish passkey registration

> Source: https://truto.one/docs/api-reference/admin/passkeys/registration-verify/

`POST /auth/passkey/registration/verify`

Resource: **Passkeys**

## Request body

- **`response`** _(object, required)_
  The `PublicKeyCredential` returned by `navigator.credentials.create()`, JSON-serialized (base64url). Extra fields the browser adds (`clientExtensionResults`, `authenticatorAttachment`) are accepted and ignored.
  - **`id`** _(string)_
    base64url credential ID. Max 64 KB.
  - **`rawId`** _(string)_
    base64url credential ID. Max 64 KB.
  - **`type`** _(string)_
    Always `public-key`. Max 64 characters.
  - **`response`** _(object, required)_
    - **`clientDataJSON`** _(string)_
      base64url. Max 64 KB.
    - **`attestationObject`** _(string)_
      base64url. Max 64 KB.
    - **`transports`** _(array<string>)_
      Transport hints reported by the authenticator. Max 16 entries of 64 characters each.
- **`name`** _(string)_
  Optional label for the credential. Trimmed; blank becomes `null`.

## Response body

- **`success`** _(boolean)_
- **`passkey`** _(object, required)_
  A registered WebAuthn credential, sanitized for display. Credential material (`credential_id`, `public_key`) is never returned.
  - **`id`** _(string)_
    The unique ID of the passkey. Use this to rename or delete it.
  - **`name`** _(string)_
    User-supplied label, or `null` when the passkey was registered without one.
  - **`device_type`** _(string)_
    `multiDevice` for a synced passkey (iCloud Keychain, Google Password Manager); `singleDevice` for a device-bound one (a security key, or a platform authenticator that does not sync).
    Allowed: `singleDevice`, `multiDevice`, `null`
  - **`backup_state`** _(boolean)_
    Whether the credential is currently synced into a backup (the WebAuthn BS flag). Refreshed on every sign-in.
  - **`last_used_at`** _(string)_
    ISO-8601 UTC timestamp of the last successful sign-in with this passkey; `null` if it has never been used.
  - **`created_at`** _(string)_
    ISO-8601 UTC timestamp of registration.

## Code examples

### curl

```bash
curl -X POST 'https://api.truto.one/auth/passkey/registration/verify' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "response": {},
  "name": "MacBook Touch ID"
}'
```

### JavaScript

```javascript
const body = {
  "response": {},
  "name": "MacBook Touch ID"
};

const response = await fetch('https://api.truto.one/auth/passkey/registration/verify', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

url = "https://api.truto.one/auth/passkey/registration/verify"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "response": {},
    "name": "MacBook Touch ID"
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())
```