Finishes enrolment, storing the credential and the key it unwraps.

POST

/v1/passkeys

• Reverse-proxied API origin

Authorizations

• bearerAuth

Request Body^required

Media typeapplication/json

object

credential

required

object

handle

required

string

label

required

string

wrappedMasterKey

required

Base64 master key wrapped by the secret this credential derives. Opaque here: the secret never leaves the authenticator and the page it answered.

string

Example^generated

{
  "credential": {},
  "handle": "example",
  "label": "example",
  "wrappedMasterKey": "example"
}

Responses

201

Device enrolled

Media typeapplication/json

One enrolled device, as the account’s own list shows it.

object

createdAt

required

string format: date-time

id

required

string

label

required

string

lastUsedAt

string | null format: date-time

Example^generated

{
  "createdAt": "2026-04-15T12:00:00Z",
  "id": "example",
  "label": "example",
  "lastUsedAt": "2026-04-15T12:00:00Z"
}

Headers

Location

string

URL of the enrolled device

400

Unusable label or wrapped key

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

401

Challenge expired or not signed in

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

Headers

WWW-Authenticate

string

The Bearer challenge (RFC 6750).

409

Already enrolled

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

413

Wrapped key too large

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

415

The body is not JSON

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

Headers

Accept

string

The media type the operation takes.

429

Too many requests

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

Headers

Retry-After

string

Seconds to wait. Sent when the limit knows when it lifts.

500

The service failed

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}

503

The service is at capacity

Media typeapplication/problem+json

RFC 9457 problem details payload.

object

detail

Explanation specific to this occurrence, written to help correct the request.

string

errors

The invalid members of the request. Present on a validation problem.

Array<object>

One invalid member of a request, located by a JSON Pointer (RFC 6901).

object

detail

required

What is wrong with it.

string

pointer

required

JSON Pointer to the member within the request body. Empty for the whole body.

string

status

required

HTTP status code.

integer format: int32

title

required

Short summary of the problem type. For about:blank, the status phrase.

string

type

Problem type URI, which resolves to its documentation. Absent means about:blank.

string

Example^generated

{
  "detail": "example",
  "errors": [
    {
      "detail": "example",
      "pointer": "example"
    }
  ],
  "status": 1,
  "title": "example",
  "type": "example"
}