Start the registration of passkey for a user

POST 
https://$CUSTOM-DOMAIN/v2/users/:userId/passkeys

Start the registration of a passkey for a user, as a response the public key credential creation options are returned, which are used to verify the passkey..

Request

Path Parameters

userId stringrequired

application/json

Body

required

code

object

"one time code generated by ZITADEL; required to start the passkey registration without user authentication"

id stringrequired

Possible values: <= 200 characters

"id to the one time code generated by ZITADEL"

code stringrequired

Possible values: <= 200 characters

"one time code generated by ZITADEL"

authenticator string

Possible values: [PASSKEY_AUTHENTICATOR_UNSPECIFIED, PASSKEY_AUTHENTICATOR_PLATFORM, PASSKEY_AUTHENTICATOR_CROSS_PLATFORM]

Default value: PASSKEY_AUTHENTICATOR_UNSPECIFIED

"Optionally specify the authenticator type of the passkey device (platform or cross-platform). If none is provided, both values are allowed."

domain string

"Domain on which the user is authenticated."

application/grpc

Body

required

code

object

"one time code generated by ZITADEL; required to start the passkey registration without user authentication"

id stringrequired

Possible values: <= 200 characters

"id to the one time code generated by ZITADEL"

code stringrequired

Possible values: <= 200 characters

"one time code generated by ZITADEL"

authenticator string

Possible values: [PASSKEY_AUTHENTICATOR_UNSPECIFIED, PASSKEY_AUTHENTICATOR_PLATFORM, PASSKEY_AUTHENTICATOR_CROSS_PLATFORM]

Default value: PASSKEY_AUTHENTICATOR_UNSPECIFIED

"Optionally specify the authenticator type of the passkey device (platform or cross-platform). If none is provided, both values are allowed."

domain string

"Domain on which the user is authenticated."

application/grpc-web+proto

Body

required

code

object

"one time code generated by ZITADEL; required to start the passkey registration without user authentication"

id stringrequired

Possible values: <= 200 characters

"id to the one time code generated by ZITADEL"

code stringrequired

Possible values: <= 200 characters

"one time code generated by ZITADEL"

authenticator string

Possible values: [PASSKEY_AUTHENTICATOR_UNSPECIFIED, PASSKEY_AUTHENTICATOR_PLATFORM, PASSKEY_AUTHENTICATOR_CROSS_PLATFORM]

Default value: PASSKEY_AUTHENTICATOR_UNSPECIFIED

"Optionally specify the authenticator type of the passkey device (platform or cross-platform). If none is provided, both values are allowed."

domain string

"Domain on which the user is authenticated."

Responses

200

OK

application/json

Schema

Schema

details

object

sequence uint64

on read: the sequence of the last event reduced by the projection

on manipulation: the timestamp of the event(s) added by the manipulation

changeDate date-time

on read: the timestamp of the last event reduced by the projection

on manipulation: the timestamp of the event(s) added by the manipulation

resourceOwner resource_owner is the organization or instance_id an object belongs to (string)

creationDate date-time
passkeyId string
publicKeyCredentialCreationOptions object

Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions). Generated helper methods transform the field to JSON, for use in a WebauthN client. See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialcreationoptions

Example (from schema)

{
  "details": {
    "sequence": "2",
    "changeDate": "2025-03-25T09:53:34.048Z",
    "resourceOwner": "69629023906488334",
    "creationDate": "2025-03-25T09:53:34.048Z"
  },
  "passkeyId": "163840776835432705",
  "publicKeyCredentialCreationOptions": {
    "publicKey": {
      "attestation": "none",
      "authenticatorSelection": {
        "userVerification": "required"
      },
      "challenge": "XaMYwWOZ5hj6pwtwJJlpcI-ExkO5TxevBMG4R8DoKQQ",
      "excludeCredentials": [
        {
          "id": "tVp1QfYhT8DkyEHVrv7blnpAo2YJzbZgZNBf7zPs6CI",
          "type": "public-key"
        }
      ],
      "pubKeyCredParams": [
        {
          "alg": -7,
          "type": "public-key"
        }
      ],
      "rp": {
        "id": "localhost",
        "name": "ZITADEL"
      },
      "timeout": 300000,
      "user": {
        "displayName": "Tim Mohlmann",
        "id": "MjE1NTk4MDAwNDY0OTk4OTQw",
        "name": "tim"
      }
    }
  }
}

application/grpc

Schema

Schema

details

object

sequence uint64

on read: the sequence of the last event reduced by the projection

on manipulation: the timestamp of the event(s) added by the manipulation

changeDate date-time

on read: the timestamp of the last event reduced by the projection

on manipulation: the timestamp of the event(s) added by the manipulation

resourceOwner resource_owner is the organization or instance_id an object belongs to (string)

creationDate date-time
passkeyId string
publicKeyCredentialCreationOptions object

Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions). Generated helper methods transform the field to JSON, for use in a WebauthN client. See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialcreationoptions

Example (from schema)

{
  "details": {
    "sequence": "2",
    "changeDate": "2025-03-25T09:53:34.048Z",
    "resourceOwner": "69629023906488334",
    "creationDate": "2025-03-25T09:53:34.048Z"
  },
  "passkeyId": "163840776835432705",
  "publicKeyCredentialCreationOptions": {
    "publicKey": {
      "attestation": "none",
      "authenticatorSelection": {
        "userVerification": "required"
      },
      "challenge": "XaMYwWOZ5hj6pwtwJJlpcI-ExkO5TxevBMG4R8DoKQQ",
      "excludeCredentials": [
        {
          "id": "tVp1QfYhT8DkyEHVrv7blnpAo2YJzbZgZNBf7zPs6CI",
          "type": "public-key"
        }
      ],
      "pubKeyCredParams": [
        {
          "alg": -7,
          "type": "public-key"
        }
      ],
      "rp": {
        "id": "localhost",
        "name": "ZITADEL"
      },
      "timeout": 300000,
      "user": {
        "displayName": "Tim Mohlmann",
        "id": "MjE1NTk4MDAwNDY0OTk4OTQw",
        "name": "tim"
      }
    }
  }
}

application/grpc-web+proto

Schema

Schema

details

object

sequence uint64

on read: the sequence of the last event reduced by the projection

on manipulation: the timestamp of the event(s) added by the manipulation

changeDate date-time

on read: the timestamp of the last event reduced by the projection

on manipulation: the timestamp of the event(s) added by the manipulation

resourceOwner resource_owner is the organization or instance_id an object belongs to (string)

creationDate date-time
passkeyId string
publicKeyCredentialCreationOptions object

Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions). Generated helper methods transform the field to JSON, for use in a WebauthN client. See also: https://www.w3.org/TR/webauthn/#dictdef-publickeycredentialcreationoptions

Example (from schema)

{
  "details": {
    "sequence": "2",
    "changeDate": "2025-03-25T09:53:34.049Z",
    "resourceOwner": "69629023906488334",
    "creationDate": "2025-03-25T09:53:34.049Z"
  },
  "passkeyId": "163840776835432705",
  "publicKeyCredentialCreationOptions": {
    "publicKey": {
      "attestation": "none",
      "authenticatorSelection": {
        "userVerification": "required"
      },
      "challenge": "XaMYwWOZ5hj6pwtwJJlpcI-ExkO5TxevBMG4R8DoKQQ",
      "excludeCredentials": [
        {
          "id": "tVp1QfYhT8DkyEHVrv7blnpAo2YJzbZgZNBf7zPs6CI",
          "type": "public-key"
        }
      ],
      "pubKeyCredParams": [
        {
          "alg": -7,
          "type": "public-key"
        }
      ],
      "rp": {
        "id": "localhost",
        "name": "ZITADEL"
      },
      "timeout": 300000,
      "user": {
        "displayName": "Tim Mohlmann",
        "id": "MjE1NTk4MDAwNDY0OTk4OTQw",
        "name": "tim"
      }
    }
  }
}

403

Returned when the user does not have permission to access the resource.

application/json

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

application/grpc

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

application/grpc-web+proto

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

404

Returned when the resource does not exist.

application/json

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

application/grpc

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

application/grpc-web+proto

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

default

An unexpected error response.

application/json

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

application/grpc

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

application/grpc-web+proto

Schema

Schema

code int32
message string

details

object[]

Array [

@type string

]

Example (from schema)

{
  "code": 0,
  "message": "string",
  "details": [
    {
      "@type": "string"
    }
  ]
}

• curl
• python
• go
• nodejs
• ruby
• csharp
• php
• java
• powershell

• CURL

curl -L 'https://$CUSTOM-DOMAIN/v2/users/:userId/passkeys' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
-d '{
  "code": {
    "id": "e2a48d6a-362b-4db6-a1fb-34feab84dc62",
    "code": "SomeSpecialCode"
  },
  "authenticator": "PASSKEY_AUTHENTICATOR_UNSPECIFIED",
  "domain": "string"
}'

Request Collapse all

Base URL

https://$CUSTOM-DOMAIN

Auth

Bearer Token

Parameters

userId — pathrequired

Body required

Content-Type

application/jsonapplication/grpcapplication/grpc-web+proto

{
  "code": {
    "id": "e2a48d6a-362b-4db6-a1fb-34feab84dc62",
    "code": "SomeSpecialCode"
  },
  "authenticator": "PASSKEY_AUTHENTICATOR_UNSPECIFIED",
  "domain": "string"
}

ResponseClear

Click the Send API Request button above and see the response here!