webauthn

Written for: ＋ Written for
Deprecated: ＋ Deprecated
Applies to: ＋ Applies to

AdminUpdated Sep 19, 2026

POSThttps://api.chatlychat.com/v1/auth/webauthn/register/options

Begin passkey registration (authenticated step-up)

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	no	UUIDv4 or 16-128 char opaque token. Required on write endpoints in production. Replays return the cached response with `Idempotency-Replay: true`; reusing the key with a different body returns 409 idempotency_conflict.

Responses

201

Code samples

cURL

curl -X POST "https://api.chatlychat.com/v1/auth/webauthn/register/options" \
  -H "Idempotency-Key: <value>"

TypeScript

const res = await fetch('https://api.chatlychat.com/v1/auth/webauthn/register/options', {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<value>',
  },
});
const data = await res.json();

Python

import requests

res = requests.request(
    "POST",
    "https://api.chatlychat.com/v1/auth/webauthn/register/options",
    headers={
    "Idempotency-Key": "<value>",
    },
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.chatlychat.com/v1/auth/webauthn/register/options", nil)
	req.Header.Set("Idempotency-Key", "<value>")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.chatlychat.com/v1/auth/webauthn/register/options');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Idempotency-Key: <value>']);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.chatlychat.com/v1/auth/webauthn/register/options')
req = Net::HTTP::Post.new(uri)
req['Idempotency-Key'] = '<value>'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.chatlychat.com/v1/auth/webauthn/register/options"))
    .header("Idempotency-Key", "<value>")
    .method("POST", BodyPublishers.noBody())
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

POSThttps://api.chatlychat.com/v1/auth/webauthn/register/verify

Complete passkey registration

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	no	UUIDv4 or 16-128 char opaque token. Required on write endpoints in production. Replays return the cached response with `Idempotency-Replay: true`; reusing the key with a different body returns 409 idempotency_conflict.

Request body application/json

{
  "response": {
    "id": "string",
    "rawId": "string",
    "response": {
      "clientDataJSON": "string",
      "attestationObject": "string",
      "transports": [
        "string"
      ]
    },
    "clientExtensionResults": {},
    "type": "public-key",
    "authenticatorAttachment": "string"
  },
  "nickname": "string"
}

Responses

201

Code samples

cURL

curl -X POST "https://api.chatlychat.com/v1/auth/webauthn/register/verify" \
  -H "Idempotency-Key: <value>" \
  -H "Content-Type: application/json" \
  -d '{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","attestationObject":"string","transports":["string"]},"clientExtensionResults":{},"type":"public-key","authenticatorAttachment":"string"},"nickname":"string"}'

TypeScript

const res = await fetch('https://api.chatlychat.com/v1/auth/webauthn/register/verify', {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<value>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","attestationObject":"string","transports":["string"]},"clientExtensionResults":{},"type":"public-key","authenticatorAttachment":"string"},"nickname":"string"}),
});
const data = await res.json();

Python

import requests

res = requests.request(
    "POST",
    "https://api.chatlychat.com/v1/auth/webauthn/register/verify",
    headers={
    "Idempotency-Key": "<value>",
    "Content-Type": "application/json",
    },
    json={"response": {"id": "string", "rawId": "string", "response": {"clientDataJSON": "string", "attestationObject": "string", "transports": ["string"]}, "clientExtensionResults": {}, "type": "public-key", "authenticatorAttachment": "string"}, "nickname": "string"},
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.chatlychat.com/v1/auth/webauthn/register/verify", strings.NewReader(`{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","attestationObject":"string","transports":["string"]},"clientExtensionResults":{},"type":"public-key","authenticatorAttachment":"string"},"nickname":"string"}`))
	req.Header.Set("Idempotency-Key", "<value>")
	req.Header.Set("Content-Type", "application/json")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.chatlychat.com/v1/auth/webauthn/register/verify');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Idempotency-Key: <value>', 'Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","attestationObject":"string","transports":["string"]},"clientExtensionResults":{},"type":"public-key","authenticatorAttachment":"string"},"nickname":"string"}');
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.chatlychat.com/v1/auth/webauthn/register/verify')
req = Net::HTTP::Post.new(uri)
req['Idempotency-Key'] = '<value>'
req['Content-Type'] = 'application/json'
req.body = '{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","attestationObject":"string","transports":["string"]},"clientExtensionResults":{},"type":"public-key","authenticatorAttachment":"string"},"nickname":"string"}'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.chatlychat.com/v1/auth/webauthn/register/verify"))
    .header("Idempotency-Key", "<value>")
    .header("Content-Type", "application/json")
    .method("POST", BodyPublishers.ofString("{\"response\":{\"id\":\"string\",\"rawId\":\"string\",\"response\":{\"clientDataJSON\":\"string\",\"attestationObject\":\"string\",\"transports\":[\"string\"]},\"clientExtensionResults\":{},\"type\":\"public-key\",\"authenticatorAttachment\":\"string\"},\"nickname\":\"string\"}"))
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

POSThttps://api.chatlychat.com/v1/auth/webauthn/login/options

Begin a passwordless passkey login — returns challenge + allowed credentials

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	no	UUIDv4 or 16-128 char opaque token. Required on write endpoints in production. Replays return the cached response with `Idempotency-Replay: true`; reusing the key with a different body returns 409 idempotency_conflict.

Request body application/json

{
  "email": "string"
}

Responses

201

Code samples

cURL

curl -X POST "https://api.chatlychat.com/v1/auth/webauthn/login/options" \
  -H "Idempotency-Key: <value>" \
  -H "Content-Type: application/json" \
  -d '{"email":"string"}'

TypeScript

const res = await fetch('https://api.chatlychat.com/v1/auth/webauthn/login/options', {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<value>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"email":"string"}),
});
const data = await res.json();

Python

import requests

res = requests.request(
    "POST",
    "https://api.chatlychat.com/v1/auth/webauthn/login/options",
    headers={
    "Idempotency-Key": "<value>",
    "Content-Type": "application/json",
    },
    json={"email": "string"},
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.chatlychat.com/v1/auth/webauthn/login/options", strings.NewReader(`{"email":"string"}`))
	req.Header.Set("Idempotency-Key", "<value>")
	req.Header.Set("Content-Type", "application/json")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.chatlychat.com/v1/auth/webauthn/login/options');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Idempotency-Key: <value>', 'Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"email":"string"}');
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.chatlychat.com/v1/auth/webauthn/login/options')
req = Net::HTTP::Post.new(uri)
req['Idempotency-Key'] = '<value>'
req['Content-Type'] = 'application/json'
req.body = '{"email":"string"}'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.chatlychat.com/v1/auth/webauthn/login/options"))
    .header("Idempotency-Key", "<value>")
    .header("Content-Type", "application/json")
    .method("POST", BodyPublishers.ofString("{\"email\":\"string\"}"))
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

POSThttps://api.chatlychat.com/v1/auth/webauthn/login/verify

Complete passwordless passkey login — returns auth tokens

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	no	UUIDv4 or 16-128 char opaque token. Required on write endpoints in production. Replays return the cached response with `Idempotency-Replay: true`; reusing the key with a different body returns 409 idempotency_conflict.

Request body application/json

{
  "response": {
    "id": "string",
    "rawId": "string",
    "response": {
      "clientDataJSON": "string",
      "authenticatorData": "string",
      "signature": "string",
      "userHandle": "string"
    },
    "clientExtensionResults": {},
    "type": "public-key"
  }
}

Responses

201

Code samples

cURL

curl -X POST "https://api.chatlychat.com/v1/auth/webauthn/login/verify" \
  -H "Idempotency-Key: <value>" \
  -H "Content-Type: application/json" \
  -d '{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","authenticatorData":"string","signature":"string","userHandle":"string"},"clientExtensionResults":{},"type":"public-key"}}'

TypeScript

const res = await fetch('https://api.chatlychat.com/v1/auth/webauthn/login/verify', {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<value>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","authenticatorData":"string","signature":"string","userHandle":"string"},"clientExtensionResults":{},"type":"public-key"}}),
});
const data = await res.json();

Python

import requests

res = requests.request(
    "POST",
    "https://api.chatlychat.com/v1/auth/webauthn/login/verify",
    headers={
    "Idempotency-Key": "<value>",
    "Content-Type": "application/json",
    },
    json={"response": {"id": "string", "rawId": "string", "response": {"clientDataJSON": "string", "authenticatorData": "string", "signature": "string", "userHandle": "string"}, "clientExtensionResults": {}, "type": "public-key"}},
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.chatlychat.com/v1/auth/webauthn/login/verify", strings.NewReader(`{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","authenticatorData":"string","signature":"string","userHandle":"string"},"clientExtensionResults":{},"type":"public-key"}}`))
	req.Header.Set("Idempotency-Key", "<value>")
	req.Header.Set("Content-Type", "application/json")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.chatlychat.com/v1/auth/webauthn/login/verify');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Idempotency-Key: <value>', 'Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POSTFIELDS, '{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","authenticatorData":"string","signature":"string","userHandle":"string"},"clientExtensionResults":{},"type":"public-key"}}');
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.chatlychat.com/v1/auth/webauthn/login/verify')
req = Net::HTTP::Post.new(uri)
req['Idempotency-Key'] = '<value>'
req['Content-Type'] = 'application/json'
req.body = '{"response":{"id":"string","rawId":"string","response":{"clientDataJSON":"string","authenticatorData":"string","signature":"string","userHandle":"string"},"clientExtensionResults":{},"type":"public-key"}}'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.chatlychat.com/v1/auth/webauthn/login/verify"))
    .header("Idempotency-Key", "<value>")
    .header("Content-Type", "application/json")
    .method("POST", BodyPublishers.ofString("{\"response\":{\"id\":\"string\",\"rawId\":\"string\",\"response\":{\"clientDataJSON\":\"string\",\"authenticatorData\":\"string\",\"signature\":\"string\",\"userHandle\":\"string\"},\"clientExtensionResults\":{},\"type\":\"public-key\"}}"))
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

GEThttps://api.chatlychat.com/v1/auth/webauthn/credentials

List passkeys for the current user

Parameters

Name	In	Type	Required	Description
`Idempotency-Key`	header	string	no	UUIDv4 or 16-128 char opaque token. Required on write endpoints in production. Replays return the cached response with `Idempotency-Replay: true`; reusing the key with a different body returns 409 idempotency_conflict.

Responses

200

Code samples

cURL

curl -X GET "https://api.chatlychat.com/v1/auth/webauthn/credentials" \
  -H "Idempotency-Key: <value>"

TypeScript

const res = await fetch('https://api.chatlychat.com/v1/auth/webauthn/credentials', {
  method: 'GET',
  headers: {
    'Idempotency-Key': '<value>',
  },
});
const data = await res.json();

Python

import requests

res = requests.request(
    "GET",
    "https://api.chatlychat.com/v1/auth/webauthn/credentials",
    headers={
    "Idempotency-Key": "<value>",
    },
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.chatlychat.com/v1/auth/webauthn/credentials", nil)
	req.Header.Set("Idempotency-Key", "<value>")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.chatlychat.com/v1/auth/webauthn/credentials');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Idempotency-Key: <value>']);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.chatlychat.com/v1/auth/webauthn/credentials')
req = Net::HTTP::Get.new(uri)
req['Idempotency-Key'] = '<value>'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.chatlychat.com/v1/auth/webauthn/credentials"))
    .header("Idempotency-Key", "<value>")
    .GET()
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

DELETEhttps://api.chatlychat.com/v1/auth/webauthn/credentials/{id}

Remove a passkey

Parameters

Name	In	Type	Required	Description
`id`	path	string	yes
`Idempotency-Key`	header	string	no	UUIDv4 or 16-128 char opaque token. Required on write endpoints in production. Replays return the cached response with `Idempotency-Replay: true`; reusing the key with a different body returns 409 idempotency_conflict.

Responses

200

Code samples

cURL

curl -X DELETE "https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}" \
  -H "Idempotency-Key: <value>"

TypeScript

const res = await fetch('https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}', {
  method: 'DELETE',
  headers: {
    'Idempotency-Key': '<value>',
  },
});
const data = await res.json();

Python

import requests

res = requests.request(
    "DELETE",
    "https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}",
    headers={
    "Idempotency-Key": "<value>",
    },
)
data = res.json()

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, _ := http.NewRequest("DELETE", "https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}", nil)
	req.Header.Set("Idempotency-Key", "<value>")
	res, _ := http.DefaultClient.Do(req)
	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)
	fmt.Println(string(body))
}

PHP

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Idempotency-Key: <value>']);
$response = curl_exec($ch);
curl_close($ch);
echo $response;

Ruby

require 'net/http'
require 'uri'

uri = URI('https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}')
req = Net::HTTP::Delete.new(uri)
req['Idempotency-Key'] = '<value>'
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(req)
end
puts res.body

Java

import java.net.URI;
import java.net.http.*;
import java.net.http.HttpRequest.BodyPublishers;

HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.chatlychat.com/v1/auth/webauthn/credentials/{id}"))
    .header("Idempotency-Key", "<value>")
    .method("DELETE", BodyPublishers.noBody())
    .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

Was this page helpful?