Complete a passwordless passkey sign-in
const url = 'https://api.aetherpush.com/v1/auth/passkey/login';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"response":{}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/auth/passkey/login \ --header 'Content-Type: application/json' \ --data '{ "response": {} }'Verifies a discoverable-credential assertion and issues the session access key. The credential is resolved globally by its id, the asserted userHandle must match the credential’s owner, and user verification is required.
Request Bodyrequired
Section titled “Request Bodyrequired”object
WebAuthn AuthenticationResponseJSON from a discoverable
credential, as returned by startAuthentication() from
@simplewebauthn/browser.
object
Example generated
{ "response": {}}Responses
Section titled “Responses”Signed in. Use the returned access key as a Bearer token.
object
Raw bearer token. Send as Authorization: Bearer <accessKey>
on subsequent requests. Store securely (cookie or secure
storage). The server cannot reveal it again.
Unix timestamp in milliseconds at which this token expires.
Present and true when the account has no MFA method yet. Every
account is expected to enroll a passkey or an authenticator app.
The dashboard nags until mfaSetupDeadline and blocks
navigation after it. Clients that cannot enroll (the CLI) may
ignore this field.
Unix timestamp in milliseconds. Present alongside
mfaSetupRequired; fixed on the account’s first MFA-less login
and stable on later logins. Before it, MFA setup is a
dismissible prompt; after it, the dashboard requires setup
before continuing.
Example
{ "accessKey": "abc123-base64url-secret", "expires": 1719964800000}Malformed WebAuthn response.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}Unknown challenge or credential, or the assertion failed.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}The account’s email address is not verified. The assertion itself was accepted, so this refusal is reached only after the passkey verified; no session is issued.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "Please verify your email address before logging in.", "code": "email_not_verified"}Too many attempts.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Example
{ "error": "Too many login attempts. Please try again later.", "code": "too_many_login_attempts", "retryAfterSeconds": 900, "requestId": "req_abc123"}Passkeys are not configured on this server.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}