Security – API reference

Sign in with passkey

POST/api/v1/security/login/passkey

Public. Verifies the passkey signature and issues a Firebase custom token (signInWithCustomToken). The session counts as two-factor verified. Email verification and account approval are then checked as usual.

No authentication required.

Body (JSON)

challengeIdstringrequired
max. 100 characters
responseWebAuthnAuthenticationResponserequired
- idstringrequired
  max. 4096 characters
- rawIdstringrequired
  max. 4096 characters
- type"public-key"required
- responseobjectrequired
  - clientDataJSONstringrequired
    max. 4096 characters
  - authenticatorDatastringrequired
    max. 4096 characters
  - signaturestringrequired
    max. 4096 characters
  - userHandlestring
    max. 1024 characters
- authenticatorAttachmentstring
- clientExtensionResultsobject
  Default: {}

Response 200 · MfaSession

customTokenstringrequired
Firebase custom token. Sign in with signInWithCustomToken() – the new session counts as confirmed with two factors.
method"passkey" | "totp" | "recovery_code"required
expiresAtstringrequired
Until when the confirmation is valid; after that, the second factor is requested again.

Possible errors: 400, 403, 429, 500

curl -X POST 'https://www.debt-flow.io/api/v1/security/login/passkey' \
  -H 'Content-Type: application/json' \
  -d '{
  "challengeId": "string",
  "response": {
    "id": "string",
    "rawId": "string",
    "type": "public-key",
    "response": {
      "clientDataJSON": "string",
      "authenticatorData": "string",
      "signature": "string",
      "userHandle": "string"
    },
    "authenticatorAttachment": "string",
    "clientExtensionResults": {}
  }
}'

Response 200

{
  "customToken": "string",
  "method": "passkey",
  "expiresAt": "string"
}

Start passkey sign-in

POST/api/v1/security/login/passkey-options

Public. Returns the options for navigator.credentials.get() (discoverable passkeys, user verification required). Then POST /security/login/passkey.

No authentication required.

Response 200 · WebAuthnChallenge

challengeIdstringrequired
Include when completing
optionsobjectrequired
Pass to navigator.credentials (or @simplewebauthn/browser)
expiresAtstringrequired
Timestamp (ISO 8601)

Possible errors: 400, 429, 500

curl -X POST 'https://www.debt-flow.io/api/v1/security/login/passkey-options'

Response 200

{
  "challengeId": "string",
  "options": {},
  "expiresAt": "string"
}