Keys and accounts
Passkey accounts
A passkey is the login for a root account, with no email, form or password. It works with any WebAuthn authenticator that can verify you (Windows Hello, iCloud Keychain, Google Password Manager, 1Password, Android, security keys with a PIN).
On this page
How it works
- The account is a root balance that nobody holds a secret for: it is never used for inference. You spend with minted keys, which are child keys. A lost minted key is not a disaster: delete it, its balance returns, and mint another.
- Logging in returns a session token (
ses_…), valid for 30 days or until logout. It works on the management routes a root key can use (/v1/key,/v1/keys/children…,/v1/credits…,/v1/receipts…), and is refused on every metered route with401 session_not_allowed. - The console keeps the session in
sessionStorageonly. The Playground mints a short-lived child key through it. - An account holds at most 10 passkeys. Adding or removing one needs a passkey login in the last five minutes (
403 reauth_required).
Keep a second passkey
If every passkey of an account is lost with no other way in, its root balance cannot be reached again. Minted keys keep working and can be spent down.
Endpoints
| Request | Auth | Result |
|---|---|---|
POST /v1/passkeys/register/options {name?} | none, or a session to add a device | {challenge_id, options} |
POST /v1/passkeys/register/verify {challenge_id, response, name?} | same | New account: 201 {session, expires_at, passkey, root}. With a session: {passkey, root} |
POST /v1/passkeys/login/options {} | none | Discoverable login options |
POST /v1/passkeys/login/verify {challenge_id, response} | none | {session, expires_at, root} |
GET /v1/passkeys | session | The account's passkeys |
DELETE /v1/passkeys/:id | session | The last one needs ?confirm=lose_access, else 409 last_passkey |
POST /v1/session/logout | session | Ends this session |
POST /v1/session/logout-all | session | Ends every session of the account |
Challenges last five minutes and are single use. Option and registration requests are limited to 120 per hour and login attempts to 60 per hour per client address.
Last updated