Begin a passwordless passkey login

POST/api/auth/login/passkey/start

passkeyLoginStart

Public. Takes no body — and deliberately so: a discoverable credential means the authenticator resolves which account is signing in, so there is no username here and therefore nothing to enumerate. Returns a `challenge_id` plus the `publicKey` options for `navigator.credentials.get()`. Rate limited per IP.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/login/passkey/start'

fetch

fetch("https://neosource.dev/api/auth/login/passkey/start", {
  method: "POST",
});

Responses

200Ceremony started

application/json

PasskeyAuthStartResponse

object

A started authentication ceremony — used by both passwordless login and passkey sudo.

challenge_idrequired: string
Opaque handle for the in-flight ceremony. Echo it back to `/finish`. Single-use, and expires after five minutes.
optionsrequired: The `publicKey` argument for `navigator.credentials.get()`. Pass through verbatim.

Standard errors

Bodies documented once for the whole API — see standard errors.

429Rate limited — retry after the interval in the `Retry-After` header
500Passkeys are not configured on this deployment
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget