Start passkey authentication for a pending login
const url = 'https://api.aetherpush.com/v1/auth/mfa/challenge';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"pendingToken":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/auth/mfa/challenge \ --header 'Content-Type: application/json' \ --data '{ "pendingToken": "example" }'Exchanges a pending login token (from a mfaRequired login response)
for WebAuthn authentication options. Overlapping calls leave each
returned challenge verifiable until it expires or is used; the server
keeps at most five live authentication challenges per account and
consumes the oldest when that cap is exceeded. Does not count against
the pending login’s five-attempt budget; only verification calls do.
Rate limited like login: 5 failed attempts per client address per
15 minutes.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Example generated
{ "pendingToken": "example"}Responses
Section titled “Responses”WebAuthn authentication options to pass to the browser.
object
WebAuthn PublicKeyCredentialRequestOptionsJSON, as produced by
SimpleWebAuthn’s generateAuthenticationOptions(). Pass it to
startAuthentication() from @simplewebauthn/browser.
object
Example generated
{ "options": {}}Pending token missing, or the account has no passkeys.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}The pending login is invalid, consumed, or expired.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Too many MFA attempts.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Example
{ "error": "Too many login attempts. Please try again later.", "code": "too_many_login_attempts", "retryAfterSeconds": 900, "requestId": "req_abc123"}Passkeys are not configured on this server.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}