Complete login with a passkey assertion
const url = 'https://api.aetherpush.com/v1/auth/mfa/verify';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"pendingToken":"example","response":{}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/auth/mfa/verify \ --header 'Content-Type: application/json' \ --data '{ "pendingToken": "example", "response": {} }'Verifies the WebAuthn assertion for a pending login and, on success, consumes the pending token and issues the session access key exactly as a non-MFA login would.
Request Bodyrequired
Section titled “Request Bodyrequired”object
WebAuthn AuthenticationResponseJSON, as returned by
startAuthentication() from @simplewebauthn/browser.
object
Example generated
{ "pendingToken": "example", "response": {}}Responses
Section titled “Responses”MFA satisfied. Use the returned access key as a Bearer token.
object
Raw bearer token. Send as Authorization: Bearer <accessKey>
on subsequent requests. Store securely (cookie or secure
storage). The server cannot reveal it again.
Unix timestamp in milliseconds at which this token expires.
Present and true when the account has no MFA method yet. Every
account is expected to enroll a passkey or an authenticator app.
The dashboard nags until mfaSetupDeadline and blocks
navigation after it. Clients that cannot enroll (the CLI) may
ignore this field.
Unix timestamp in milliseconds. Present alongside
mfaSetupRequired; fixed on the account’s first MFA-less login
and stable on later logins. Before it, MFA setup is a
dismissible prompt; after it, the dashboard requires setup
before continuing.
Example
{ "accessKey": "abc123-base64url-secret", "expires": 1719964800000}Malformed request or WebAuthn response.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}The pending login is invalid or expired, the challenge does not match, or the assertion failed verification.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Too many MFA attempts.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Example
{ "error": "Too many login attempts. Please try again later.", "code": "too_many_login_attempts", "retryAfterSeconds": 900, "requestId": "req_abc123"}Passkeys are not configured on this server.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}