Grant a sudo-mode window by proving a passkey

POST/api/auth/sudo/passkey/finish

sudoPasskeyFinish

Authenticated (session cookie). Verifies the assertion and stamps `sessions.sudo_until = now() + 5min`, the same window the password and TOTP sudo routes grant. The challenge must be one this session's account started for **sudo** specifically — a challenge from the public login endpoint is refused, which is what stops an unauthenticated ceremony being spent to clear the step-up gate. Per-session rate limit: 5 attempts per 15 minutes.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/sudo/passkey/finish' \
  -b 'ns_session=$NEOSOURCE_SESSION' \
  -H 'Content-Type: application/json' \
  -d '{"challenge_id":"string","response":"string"}'

fetch

fetch("https://neosource.dev/api/auth/sudo/passkey/finish", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  credentials: "include",
  body: JSON.stringify({"challenge_id":"string","response":"string"}),
});

Request bodyrequired

application/json

PasskeyAuthFinishRequest

object

Completes an authentication ceremony — login or sudo.

challenge_idrequired: string
responserequired: The `PublicKeyCredential` returned by `navigator.credentials.get()`, serialised to JSON.

additional propertiesnot allowed

Responses

200Sudo granted; window expires at `sudo_until`

application/json

SudoPasswordResponse

object

sudo_untilrequired: integerint64
Millis-since-epoch when the sudo window expires. The SPA can surface a countdown or just rely on retrying the original request — a fresh 403 means sudo has lapsed.

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bearer-token caller has no session to grant sudo on
401Authentication required
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget