List this account's registered passkeys

GET/api/auth/webauthn/credentials

listPasskeys

Authenticated (session cookie). Returns the account's own passkeys, newest first. Reading the list is not sudo-gated — it exposes no secret, and the settings page needs it to render before the user has any reason to re-authenticate.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/auth/webauthn/credentials' \
  -b 'ns_session=$NEOSOURCE_SESSION'

fetch

fetch("https://neosource.dev/api/auth/webauthn/credentials", {
  method: "GET",
  credentials: "include",
});

Responses

200The account's passkeys

application/json

PasskeyListResponse

object

passkeysrequired

array

items

PasskeySummary

object

One registered authenticator, as shown in `/settings/security`.

created_atrequired: integerint64
Millis since epoch.
credential_idrequired: string
Base64url (unpadded) credential ID — the handle for rename and delete. Opaque; do not parse.
labelrequired: string
last_used_at: integer | nullint64
Millis since epoch; absent until the passkey is first used.
transports: string | null
Comma-separated transport hints the browser reported at registration (`"usb,nfc,hybrid,internal"`), when it reported any. Advisory only — used to pick an icon.

Standard errors

Bodies documented once for the whole API — see standard errors.

401Authentication required
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget