Begin a passkey sudo step-up

POST/api/auth/sudo/passkey/start

sudoPasskeyStart

Authenticated (session cookie), not sudo-gated — this *is* how sudo is acquired. Unlike login this ceremony is not discoverable: the account is already known, so the options carry an allow-list of exactly that account's credentials. An account with no registered passkey gets `401` rather than a ceremony that could only fail.

Requires authentication using a session cookie — see tokens and scopes.

curl

curl -X POST 'https://neosource.dev/api/auth/sudo/passkey/start' \
  -b 'ns_session=$NEOSOURCE_SESSION'

fetch

fetch("https://neosource.dev/api/auth/sudo/passkey/start", {
  method: "POST",
  credentials: "include",
});

Responses

200Ceremony started

application/json

PasskeyAuthStartResponse

object

A started authentication ceremony — used by both passwordless login and passkey sudo.

challenge_idrequired: string
Opaque handle for the in-flight ceremony. Echo it back to `/finish`. Single-use, and expires after five minutes.
optionsrequired: The `publicKey` argument for `navigator.credentials.get()`. Pass through verbatim.

Standard errors

Bodies documented once for the whole API — see standard errors.

400Bearer-token caller has no session to grant sudo on
401Authentication required
429Rate limited — retry after the `Retry-After` header
500Internal server error
503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
504Gateway timeout — the request exceeded the server's handling budget