Skip to content

Register for logged-in user

Request

Complete WebAuthn credential registration for a user that is currently logged in using a different Transmit authentication method. This API must be called from the backend using the user access token returned upon successful authentication. If successful, the credential will be registered for the user that corresponds to the authorization token.

Security
UserAccessToken
Bodyapplication/jsonrequired
webauthn_encoded_resultstringrequired

WebAuthn attestation data returned by the browser upon credential creation. If the credential was created using navigator.credentials.create(), call toJSON() on the returned PublicKeyCredential before sending it to the backend. Optionally include deviceInfo (publicKeyId, publicKey) in the same object to bind the device to the user, so it appears in the device_keys claim of the ID token after passkey login.

device_idstring

The device associated with this registration.

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/webauthn/register \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "webauthn_encoded_result": "string",
    "device_id": "string"
  }'

Responses

Registered credential details

Bodyapplication/json
webauthn_session_idstringrequired

WebAuthn session identifier

user_idstring

Transmit user ID, autogenerated upon user creation

webauthn_usernamestringrequired

Name of user account, as specified in the WebAuthn registration

credential_idstringrequired

WebAuthn credential ID

authenticator_attachmentstringrequired

The authenticators' attachment modalities. Cross-platform authenticator are external to the current device, such as a USB security key or a different device

Enum:"platform""cross-platform"
aaguidstring

The authenticator's AAGUID

Response
{
  "webauthn_session_id": "string",
  "user_id": "string",
  "webauthn_username": "string",
  "credential_id": "string",
  "authenticator_attachment": "platform",
  "aaguid": "string"
}