# Start authentication

Start a new WebAuthn authentication. If successful, the response contains a `credential_request_options` field that should be passed to the WebAuthn `navigator.credentials.get()` API call. Note that some fields, such as `challenge` and each `id` in the `allowCredentials` list, are binary values represented as base64url-encoded strings. Before calling the WebAuthn API, parse the options using `PublicKeyCredential.parseRequestOptionsFromJSON()`.

Endpoint: POST /v1/auth/webauthn/authenticate/start

## Request fields (application/json):

  - `client_id` (string, required)
    The client ID of the application the user is trying to authenticate to.

  - `timeout` (number)
    The timeout in seconds for the authentication modal. 
    Must be between 30 and 600. 
    Default is 300 seconds.

  - `approval_data` (object)
    Flat object that contains the data that your customer should approve for a transaction signing or custom approval flow. It can contain up to 10 keys, and only alphanumeric characters, underscores, hyphens, and periods. It will be returned as a claim in the ID token upon successful authentication.
    Example: {"transaction_id":"eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT","sum":"200"}

  - `identifier` (string, required)
    Identifier value (email, phone number, user ID, or custom identifier)
    Example: name@example.com

  - `identifier_type` (string, required)
    Type of identifier (email, phone_number, user_id, username, or custom identifier type)
    Example: email

  - `username` (string)
    Name of user account, as used in the WebAuthn registration. If not provided, the authentication will start without the context of a user and it will be inferred by the chosen passkey

## Response 200:

  - `200` (unknown)
    Authentication options

## Response 200 fields (application/json):

  - `webauthn_session_id` (string, required)
    WebAuthn session identifier

  - `credential_request_options` (object, required)

  - `credential_request_options.allowCredentials` (array, required)

  - `credential_request_options.allowCredentials.type` (string, required)
    Key type. Should always be `public-key`
    Enum: "public-key"

  - `credential_request_options.allowCredentials.id` (string, required)
    The credential ID

  - `credential_request_options.allowCredentials.transports` (array, required)
    Example: ["internal"]

  - `credential_request_options.rawChallenge` (string)
    Represents the natural WebAuthn challenge. Will Only be present in approval flows

  - `credential_request_options.challenge` (string, required)

  - `credential_request_options.timeout` (number)

  - `credential_request_options.rpId` (string, required)
    Relying Party ID. Must be a valid domain pre-configured in the Admin Portal for the application

  - `credential_request_options.attestation` (string)
    Enum: "none"

  - `credential_request_options.userVerification` (string)
    Enum: "preferred", "required"

  - `credential_request_options.extensions` (object)

## Response 400:

  - `400` (unknown)
    Invalid input or webauthn configuration

## Response 400 fields (application/json):

  - `error_code` (string)
    Enum: "system_invalid_input", "auth_webauthn_invalid_webauthn_config"

  - `message` (string)

## Response 401:

  - `401` (unknown)
    Invalid origin or no credentials registered

## Response 401 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_origin_error", "auth_not_registered"

  - `message` (string)

## Response 404:

  - `404` (unknown)
    Client not found

## Response 404 fields (application/json):

  - `error_code` (string)
    Enum: "client_not_exist"

  - `message` (string)

## Response 500:

  - `500` (unknown)
    Invalid encoded result

## Response 500 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_encoded_result"

  - `message` (string)