PropperDocs

Options for a new passkey

.md

What the phone needs to create a passkey for this account.

Scopesme:write
POST/v1/me/passkeys/options

Ask for this, hand it to the platform, then send what comes back to the register step.

The challenge inside is kept against the token that asked for it, so only the device that started the ceremony can finish it. It is spent by the next attempt, whether that attempt worked or not.

Request

curl -X POST https://api.proppertrading.com/v1/me/passkeys/options \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f"

No body.

Response

The publicKey half of a WebAuthn creation request. Field names are WebAuthn's.

{
    "data": {
        "object": "passkey_options",
        "challenge": "3q2-7_8",
        "timeout": 60000,
        "rp": { "name": "Propper", "id": "proppertrading.com" },
        "user": {
            "id": "AQIDBA",
            "name": "[email protected]",
            "displayName": "Jamie Rivera"
        },
        "pubKeyCredParams": [{ "type": "public-key", "alg": -7 }],
        "authenticatorSelection": { "userVerification": "required" },
        "excludeCredentials": []
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}

userVerification is required on purpose. The phone is asking for Face ID or a fingerprint either way, so it may as well say so to the authenticator instead of hoping.

rp.id is ours and stays ours whichever firm the account belongs to.

Errors

StatusCodeMeaning
403insufficient_scopeThis device does not hold me:write