Class PasskeyApiClient

Client for Auth0 Passkey operations.

Provides 2 public methods:

  • signup — Register a new user with a passkey (full flow: challenge → WebAuthn → token exchange)
  • login — Sign in with a passkey (full flow: challenge → WebAuthn → token exchange)

Example

// Signup — single call handles everything
const tokens = await auth0.passkey.signup({ email: 'user@example.com' });

// Login — single call handles everything
const tokens = await auth0.passkey.login();

Methods

getLoginChallenge getSignupChallenge getTokenWithPasskey login signup

Methods

getLoginChallenge

  • getLoginChallenge(options?): Promise<PasskeyLoginChallenge>

  • Request a passkey login challenge.

    Step 1 of the granular login flow. Returns the auth session and a decoded PublicKeyCredentialRequestOptions. Run the WebAuthn assertion ceremony with publicKey, then hand the resulting credential and authSession to getTokenWithPasskey().

    Parameters

    • Optional options: PasskeyLoginChallengeOptions

      Optional login challenge options (realm/organization)

    Returns Promise<PasskeyLoginChallenge>

    A promise resolving to { authSession, publicKey }

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

getSignupChallenge

  • getSignupChallenge(options): Promise<PasskeySignupChallenge>

  • Request a passkey signup challenge.

    Step 1 of the granular signup flow. Returns the auth session and a decoded PublicKeyCredentialCreationOptions. Run the WebAuthn credential creation ceremony with publicKey, then hand the resulting credential and authSession to getTokenWithPasskey().

    Parameters

    • options: PasskeySignupChallengeOptions

      Signup challenge options (user identifier, optional realm/organization/metadata)

    Returns Promise<PasskeySignupChallenge>

    A promise resolving to { authSession, publicKey }

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

getTokenWithPasskey

  • getTokenWithPasskey(options): Promise<TokenEndpointResponse>

  • Exchange a signed passkey credential for tokens.

    Step 2 of the granular flow. Serializes the raw PublicKeyCredential produced by the WebAuthn ceremony — either a creation (signup) or an assertion (login) credential — and exchanges it for tokens. The credential type (attestation vs assertion) is detected automatically.

    Parameters

    • options: PasskeyGetTokenOptions

      The auth session, raw credential, and optional realm/organization/scope/audience

    Returns Promise<TokenEndpointResponse>

    A promise resolving to the token endpoint response

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the credential is not a valid attestation or assertion response

    Throws

    If the token exchange fails

login

  • login(options?): Promise<TokenEndpointResponse>

  • Sign in with an existing passkey.

    Handles the full flow: requests a login challenge, triggers the browser WebAuthn assertion ceremony, serializes the result, and exchanges it for tokens.

    Parameters

    • Optional options: PasskeyLoginOptions

      Optional passkey login options (optional scope/audience/realm/organization)

    Returns Promise<TokenEndpointResponse>

    A promise that resolves to the token endpoint response containing access/ID tokens

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

    Throws

    If the token exchange fails

    Throws

    If the user cancels the WebAuthn prompt

signup

  • signup(options): Promise<TokenEndpointResponse>

  • Register a new user with a passkey.

    Handles the full flow: requests a signup challenge, triggers the browser WebAuthn credential creation ceremony, serializes the result, and exchanges it for tokens.

    Parameters

    Returns Promise<TokenEndpointResponse>

    A promise that resolves to the token endpoint response containing access/ID tokens

    Throws

    If WebAuthn is not supported in the browser

    Throws

    If the challenge request fails

    Throws

    If the token exchange fails

    Throws

    If the user cancels the WebAuthn prompt

Settings

Member Visibility

Theme

On This Page

getLoginChallengegetSignupChallengegetTokenWithPasskeyloginsignup