/api/auth/webauthn

Use a WebAuthn credential to login to an account.

Content-Type: application/json

The value of auth should be the result of calling navigator.credentials.get() in the browser.

Status: 200 OK

Content-Type: application/json

{
  "user": {
    "id": "cmb6042f500029kenox2u8npu",
    "username": "admin",
    "createdAt": "2025-05-27T04:13:22.625Z",
    "updatedAt": "2025-05-28T02:20:05.997Z",
    "role": "SUPERADMIN",
    "view": {},
    "oauthProviders": [],
    "totpSecret": null,
    "passkeys": [],
    "quota": null,
    "sessions": [],
    "token": "MTc0ODMxOTIwMjYyNQ==.ejV1UVFRODBJNHltU0VGZWVaTXNzRmc2UFZKUTlIMmg="
  }
}

• 400 Bad Request

  Passkeys are not enabled, missing or malformed auth payload, passkey is not recognized.

Passkeys are a "passwordless" authentication method that uses public key cryptography to securely authenticate users. They are designed to replace traditional passwords with a more secure and user-friendly alternative.

The way it works in Zipline is that users can register a passkey from the user settings page, then use that passkey on their next login attempt skipping the need for a password altogether.

• Setup Passkeys
• MDN: WebAuthn API
• MDN: AuthenticatorAssertionResponse
• MDN: navigator.credentials.get()