POST/api/auth/mfa/webauthn/optionsPublic

Start a passkey assertion for a login MFA challenge

Issues WebAuthn assertion options for the user behind a pending login MFA challenge and binds the assertion nonce to that challenge, so the signed assertion can be submitted as a webauthn proof to POST /api/auth/mfa/verify. Refuses users without a verified passkey. Rate limited per IP (shares the MFA verification budget).

operationId post_api_auth_mfa_webauthn_optionsAuthentication

Authentication & permissionsPublic

Anyone — no credentials required

Accepted credentials
None required
Notes
The challenge id issued by POST /api/auth/login is the credential.

Request body

Required — The body is parsed by the handler itself so its error format stays stable.

application/json
WebauthnLoginOptionsRequestThe challenge_id from the mfa_required login response and the client_app_id the login was for. Unknown keys are rejected.
PropertyTypeDescription
challenge_id*string (uuid)
client_app_id*string

minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$

JSONExample
"challenge_id""123e4567-e89b-12d3-a456-426614174000"
"client_app_id""string"

Responses

application/json
WebauthnLoginOptionsThe PublicKeyCredentialRequestOptionsJSON to hand to navigator.credentials.get() verbatim; allowCredentials lists every passkey the user enrolled.
PropertyTypeDescription
options*object
JSONExample
"options"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/auth/mfa/webauthn/options' \
  -H 'Content-Type: application/json' \
  -d '{
  "challenge_id": "123e4567-e89b-12d3-a456-426614174000",
  "client_app_id": "string"
}'