Auth0 React SDK
    Preparing search index...

    Interface PasskeyApiClient

    Client for Auth0 Passkey operations.

    Provides 2 public methods:

    • signup — Register a new user with a passkey (full flow: challenge → WebAuthn → token exchange)
    • login — Sign in with a passkey (full flow: challenge → WebAuthn → token exchange)
    // Signup — single call handles everything
    const tokens = await auth0.passkey.signup({ email: 'user@example.com' });

    // Login — single call handles everything
    const tokens = await auth0.passkey.login();
    interface PasskeyApiClient {
        continueSignup(
            verification: { email?: string; phone?: string },
        ): Promise<TokenEndpointResponse>;
        getLoginChallenge(
            options?: PasskeyLoginChallengeOptions,
        ): Promise<PasskeyLoginChallenge>;
        getSignupChallenge(
            options: PasskeySignupChallengeOptions,
        ): Promise<PasskeySignupChallenge>;
        getTokenWithPasskey(
            options: PasskeyGetTokenOptions,
        ): Promise<TokenEndpointResponse>;
        login(options?: PasskeyLoginOptions): Promise<TokenEndpointResponse>;
        signup(options: PasskeySignupOptions): Promise<TokenEndpointResponse>;
    }
    Index
    continueSignup getLoginChallenge getSignupChallenge getTokenWithPasskey login signup

    • Continue a signup that was interrupted by identifier verification.

      Call this after catching PasskeyVerificationRequiredError from signup(), collecting OTP codes from the user, and passing them here. The SDK internally retains the auth session — you do not need to pass it.

      If the codes are wrong but the session is still alive, this throws a PasskeyGetTokenError with isRetryable: true. Collect new codes for error.verificationRequired and call continueSignup() again; the same passkey is reused, so the user is not prompted again.

      Parameters

      • verification: { email?: string; phone?: string }

        Map of identifier → OTP code (e.g. { phone: "123456" })

      Returns Promise<TokenEndpointResponse>

      A promise resolving to the token endpoint response

      If there is no pending signup (signup() was not called first)

      If a code is missing for a required identifier. The pending signup is kept

      If an OTP code is wrong and the session is still active (isRetryable: true)

      If the token exchange fails

    • Request a passkey login challenge.

      Step 1 of the granular login flow. Returns the auth session and a decoded PublicKeyCredentialRequestOptions. Run the WebAuthn assertion ceremony with publicKey, then hand the resulting credential and authSession to getTokenWithPasskey().

      Parameters

      Returns Promise<PasskeyLoginChallenge>

      A promise resolving to { authSession, publicKey }

      If WebAuthn is not supported in the browser

      If the challenge request fails

    • Request a passkey signup challenge.

      Step 1 of the granular signup flow. Returns the auth session and a decoded PublicKeyCredentialCreationOptions. Run the WebAuthn credential creation ceremony with publicKey, then hand the resulting credential and authSession to getTokenWithPasskey().

      Parameters

      Returns Promise<PasskeySignupChallenge>

      A promise resolving to { authSession, publicKey }

      If WebAuthn is not supported in the browser

      If the challenge request fails

    • Exchange a signed passkey credential for tokens.

      Step 2 of the granular flow. Serializes the raw PublicKeyCredential produced by the WebAuthn ceremony — either a creation (signup) or an assertion (login) credential — and exchanges it for tokens. The credential type (attestation vs assertion) is detected automatically.

      Parameters

      • options: PasskeyGetTokenOptions

        The auth session, raw credential, and optional realm/organization/scope/audience

      Returns Promise<TokenEndpointResponse>

      A promise resolving to the token endpoint response

      If WebAuthn is not supported in the browser

      If the credential is not a valid attestation or assertion response

      If a code in verification is empty. Nothing is sent, so the same session can be retried

      If an OTP code is wrong and the session is still active (isRetryable: true)

      If the token exchange fails

    • Sign in with an existing passkey.

      Handles the full flow: requests a login challenge, triggers the browser WebAuthn assertion ceremony, serializes the result, and exchanges it for tokens.

      Parameters

      • Optionaloptions: PasskeyLoginOptions

        Optional passkey login options (optional scope/audience/realm/organization)

      Returns Promise<TokenEndpointResponse>

      A promise that resolves to the token endpoint response containing access/ID tokens

      If WebAuthn is not supported in the browser

      If the challenge request fails

      If the token exchange fails

      If the user cancels the WebAuthn prompt

    • Register a new user with a passkey.

      Handles the full flow: requests a signup challenge, triggers the browser WebAuthn credential creation ceremony, serializes the result, and exchanges it for tokens.

      If the server requires identifier verification, it stops before creating the passkey and throws PasskeyVerificationRequiredError. Collect the OTP codes and call continueSignup() to finish.

      Parameters

      Returns Promise<TokenEndpointResponse>

      A promise that resolves to the token endpoint response containing access/ID tokens

      If WebAuthn is not supported in the browser

      If the challenge request fails

      If OTP codes are needed before the passkey is created

      If the token exchange fails

      If the user cancels the WebAuthn prompt

    Settings
    Member Visibility

    On This Page
    Methods