auth.v1.MFAService
FinishPasskeyChallenge
Verify an MFA challenge with a passkey.
Method
POST
Path
auth.v1.MFAService/FinishPasskeyChallenge
Service
auth.v1.MFAService
Visibility
Authentication
Session token
MFA Requirement
Not required
POST
auth.v1.MFAService/FinishPasskeyChallenge Request
Testnet
curl --request POST \ \
--url 'https://api.testnet.polyester.com/auth.v1.MFAService/FinishPasskeyChallenge' \
--header 'Content-Type: application/json' \
--header 'Connect-Protocol-Version: 1' \
--data '{
"challengeId": "mfa_11111111111111111111111111111111",
"credential": {
"id": "credential-example",
"response": {
"clientDataJSON": "ZXhhbXBsZS1jbGllbnQtZGF0YQ"
},
"type": "public-key"
}
}'Responses
{
"accessToken": "eyJhbGciOiJFZERTQSJ9.example.signature",
"accessTokenExpiresAt": "2025-01-01T00:00:00Z",
"session": {
"authTime": "2025-01-01T00:00:00Z",
"authenticationMethods": [
"totp"
],
"sessionId": "session_01J0EXAMPLE",
"sessionLevel": "PRIMARY_AUTHENTICATED"
},
"stepUpExpiresAt": "2025-01-01T00:00:00Z",
"stepUpToken": "eyJhbGciOiJFZERTQSJ9.step-up.signature"
}Request
auth.v1.FinishPasskeyChallengeRequestResponse
auth.v1.CompleteMFAChallengeResponse challengeId string
Challenge identifier returned by BeginMFAChallenge.
1 field
fields object[]
Unordered map of dynamically typed values.
Edit in JSON
4 fields
sessionId string
Stable session identifier shared by the primary and MFA-elevated tokens.
sessionLevel enum
Assurance level represented by this session response.
PRIMARY_AUTHENTICATED MFA_ELEVATED FRESH_STEP_UP
authenticationMethods string[]
Authentication methods used for this session state, such as wallet, TOTP, passkey, or recovery code. Maximum 8 unique values.
authTime string (date-time)
Time when the session was authenticated or elevated.
accessToken string
MFA-elevated session token returned after every successful challenge.
accessTokenExpiresAt string (date-time)
Time when access_token expires.
stepUpToken string
Fresh step-up token returned for fresh step-up challenges. Empty for session-elevation challenges.
stepUpExpiresAt string (date-time)
Time when step_up_token expires. Empty when no step_up_token is returned.
| Key | HTTP status | Connect code | Error | When |
|---|---|---|---|---|
| unauthenticated | 401 | unauthenticated | Unauthenticated | Authentication required. |
| permission-denied | 403 | permission_denied | Permission Denied | Permission denied. |
| invalid-argument | 400 | invalid_argument | Invalid Argument | Invalid argument. |
| not-found | 404 | not_found | Not Found | Not found. |
| unavailable | 503 | unavailable | Unavailable | Service unavailable. |