Passkey Registration Verify

post/v1/auth/passkeys/register/verify

Part of Auth.

Finish enrollment. The first passkey returns recovery codes (once); the forced-enrollment lane also completes the login.

Authentication

This operation does not require an API key.

Required, application/json.

Field	Type	Description
`credential`required	object	WebAuthn registration credential (browser JSON, opaque)
`name`optional	string	User-facing label for this passkey
`mfa_token`optional	string	Enrollment token when finishing a forced enrollment

curl

curl -X POST "https://api.robosystems.ai/v1/auth/passkeys/register/verify" \
  -H "Content-Type: application/json" \
  -d '{
  "credential": {}
}'

200 Successful Response

Field Type Description

passkeyrequired

PasskeyInfo

The newly enrolled passkey

PasskeyInfo fields

Field	Type	Description
`id`required	string	Passkey identifier
`name`required	string	User-facing label
`created_at`required	string	Enrollment time (ISO 8601)
`last_used_at`optional	string	Last successful assertion time (ISO 8601)
`backup_eligible`required	boolean	Whether the credential is synced (multi-device) capable
`backup_state`required	boolean	Whether the credential is currently backed up

recovery_codesoptional

string[]

Single-use recovery codes — returned exactly once, at first enrollment

authoptional

AuthResponse

Completed login (forced-enrollment lane only)

AuthResponse fields

Field	Type	Description
`user`required	object	User information
`org`optional	object	Organization information (personal org created automatically on registration)
`message`required	string	Success message
`status`optional	string	Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present) One of: `authenticated`, `mfa_required`, `mfa_enrollment_required` Default: `authenticated`
`mfa_token`optional	string	Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
`token`optional	string	JWT authentication token (optional for cookie-based auth)
`expires_in`optional	integer	Token expiry time in seconds from now
`refresh_threshold`optional	integer	Recommended refresh threshold in seconds before expiry