Begin passkey enrollment — return WebAuthn creation options
Auth
Begin passkey enrollment — return WebAuthn creation options
Authenticated endpoint.
POST
Begin passkey enrollment — return WebAuthn creation options
Authorizations
HttpOnly, Secure, SameSite=Lax cookie issued by /v1/auth/sign-in (or the SSO / email-callback flows). The value is an AES-256-GCM-encrypted blob of {access_token, refresh_token, issued_at, auth_method}. Browser clients include this automatically with credentials: "include".
Response
WebAuthn creation options. Shape follows the WebAuthn Level 3 spec.
IdP callback landing — issues session and redirects to SPAVerify a passkey registration response + persist the credential