Start making a passkey
The options to hand the browser for a new passkey: discoverable, with user verification, and none the person has already. Send what the browser makes to `POST /v1/passkeys` within 5 minutes. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it.
/v1/passkeys/registration-optionsThe options to hand the browser for a new passkey: discoverable, with user verification, and none the person has already. Send what the browser makes to POST /v1/passkeys within 5 minutes. Needs me:write, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with max_age=300; a provider that can't show when they signed in, such as Discord, never counts), else 403 fresh_sign_in_required. Send max_age only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 email_unverified until the person verifies it.
Authorization
bearer An access token from this issuer for its account API (resource=<issuer>/me).
In: header
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/passkeys/registration-options"{ "property1": null, "property2": null}List the signed-in person's passkeys GET
Oldest first. Needs `me:read`.
Keep a new passkey POST
Checks what the browser made from the options of `POST /v1/passkeys/registration-options` (its challenge, origin, relying party and user verification) and keeps it, and emails the person's verified address that a passkey was added. Needs `me:write`, from a sign-in in the last 5 minutes whose time Synq proved (send the person to sign in with `max_age=300`; a provider that can't show when they signed in, such as Discord, never counts), else 403 `fresh_sign_in_required`. Send `max_age` only when you need a fresh sign-in: it asks someone signed in that way to sign in again. An account that signs in with an email address nobody proved yet takes no new way to sign in: 403 `email_unverified` until the person verifies it. Recorded as `user.passkey_added`.