Class PasskeyApiClient

Client for Auth0 Passkey operations.

Provides 2 public methods:

  • signup — Register a new user with a passkey (full flow: challenge → WebAuthn → token exchange)
  • login — Sign in with a passkey (full flow: challenge → WebAuthn → token exchange)

Example

// Signup — single call handles everything
const tokens = await auth0.passkey.signup({ email: 'user@example.com' });

// Login — single call handles everything
const tokens = await auth0.passkey.login();

Methods

continueSignup getLoginChallenge getSignupChallenge getTokenWithPasskey login signup

Methods

continueSignup

  • continueSignup(verification): Promise<TokenEndpointResponse>

  • Continue a signup that was interrupted by identifier verification.

    Call this after catching PasskeyVerificationRequiredError from signup(), collecting OTP codes from the user, and passing them here. The SDK internally retains the auth session — you do not need to pass it.

    If the codes are wrong but the session is still alive, this throws a PasskeyGetTokenError with isRetryable: true. Collect new codes for error.verificationRequired and call continueSignup() again; the same passkey is reused, so the user is not prompted again.

    Parameters

    • verification: {
          email?: string;
          phone?: string;
      }

      Map of identifier → OTP code (e.g. { phone: "123456" })

      • Optional email?: string
      • Optional phone?: string

    Returns Promise<TokenEndpointResponse>

    A promise resolving to the token endpoint response

    Throws

    If there is no pending signup (signup() was not called first)

    Throws

    If a code is missing for a required identifier. The pending signup is kept

    Throws

    If an OTP code is wrong and the session is still active (isRetryable: true)

    Throws

    If the token exchange fails

getLoginChallenge

  • getLoginChallenge(options?): Promise<PasskeyLoginChallenge>

  • Request a passkey login challenge.

    Step 1 of the granular login flow. Returns the auth session and a decoded PublicKeyCredentialRequestOptions. Run the WebAuthn assertion ceremony with publicKey, then hand the resulting credential and authSession to getTokenWithPasskey().

    Parameters

    Returns Promise<PasskeyLoginChallenge>

    A promise resolving to { authSession, publicKey }

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

getSignupChallenge

  • getSignupChallenge(options): Promise<PasskeySignupChallenge>

  • Request a passkey signup challenge.

    Step 1 of the granular signup flow. Returns the auth session and a decoded PublicKeyCredentialCreationOptions. Run the WebAuthn credential creation ceremony with publicKey, then hand the resulting credential and authSession to getTokenWithPasskey().

    Parameters

    Returns Promise<PasskeySignupChallenge>

    A promise resolving to { authSession, publicKey }

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

getTokenWithPasskey

  • getTokenWithPasskey(options): Promise<TokenEndpointResponse>

  • Exchange a signed passkey credential for tokens.

    Step 2 of the granular flow. Serializes the raw PublicKeyCredential produced by the WebAuthn ceremony — either a creation (signup) or an assertion (login) credential — and exchanges it for tokens. The credential type (attestation vs assertion) is detected automatically.

    Parameters

    • options: PasskeyGetTokenOptions

      The auth session, raw credential, and optional realm/organization/scope/audience

    Returns Promise<TokenEndpointResponse>

    A promise resolving to the token endpoint response

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the credential is not a valid attestation or assertion response

    Throws

    If a code in verification is empty. Nothing is sent, so the same session can be retried

    Throws

    If an OTP code is wrong and the session is still active (isRetryable: true)

    Throws

    If the token exchange fails

login

  • login(options?): Promise<TokenEndpointResponse>

  • Sign in with an existing passkey.

    Handles the full flow: requests a login challenge, triggers the browser WebAuthn assertion ceremony, serializes the result, and exchanges it for tokens.

    Parameters

    • Optional options: PasskeyLoginOptions

      Optional passkey login options (optional scope/audience/realm/organization)

    Returns Promise<TokenEndpointResponse>

    A promise that resolves to the token endpoint response containing access/ID tokens

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

    Throws

    If the token exchange fails

    Throws

    If the user cancels the WebAuthn prompt

signup

  • signup(options): Promise<TokenEndpointResponse>

  • Register a new user with a passkey.

    Handles the full flow: requests a signup challenge, triggers the browser WebAuthn credential creation ceremony, serializes the result, and exchanges it for tokens.

    If the server requires identifier verification, it stops before creating the passkey and throws PasskeyVerificationRequiredError. Collect the OTP codes and call continueSignup() to finish.

    Parameters

    Returns Promise<TokenEndpointResponse>

    A promise that resolves to the token endpoint response containing access/ID tokens

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

    Throws

    If OTP codes are needed before the passkey is created

    Throws

    If the token exchange fails

    Throws

    If the user cancels the WebAuthn prompt

Settings

Member Visibility

Theme

On This Page

continueSignupgetLoginChallengegetSignupChallengegetTokenWithPasskeyloginsignup