Sign-in · registerPasskey

Add a passkey

POST /api/auth/passkeys/register

Verifies the authenticator's response (user verification required) and saves the passkey. Needs a sign-in from the last 24 hours (forbidden otherwise).

Who may call it: Anyone (no credentials)
Server: https://api.logu.dev

Request body#

Content type application/json (required).

Field	Type	Required	Notes
`response`	`object`	required	The authenticator's response (`startRegistration` / `startAuthentication`).
`challengeToken`	`string`	required	16–1000 chars
`name`	`string`	optional	Registration only: a name (≤ 64).

{
  "response": {
    "id": "cred"
  },
  "challengeToken": "aS7dQ2xLp9Vt4mKz.signature",
  "name": "Chrome · macOS"
}

Example#

curl -s -X POST "https://api.logu.dev/api/auth/passkeys/register" \
  -H "Authorization: Bearer $LOGU_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"response":{"id":"cred"},"challengeToken":"aS7dQ2xLp9Vt4mKz.signature","name":"Chrome · macOS"}'

Responses#

201

The passkey.

{
  "id": "pk_9f2c1e",
  "name": "Chrome · macOS",
  "provider": "Google Password Manager",
  "backedUp": true,
  "createdAt": "2026-10-12T14:03:11.000Z"
}

Response fields

Field	Type	Required
`id`	`string`	required
`name`	`string \| null`	required
`provider`	`string \| null`	required
`backedUp`	`boolean`	required
`createdAt`	`string \| null`	required

Errors#

Every error is {"error":{"code","message","hint","docUrl","requestId"}}: branch on code. See Errors.

Status	Code	Meaning
400	`unknown_field`	The body has a field the endpoint doesn't know (often a typo or snake_case).
400	`bad_request`	The request is malformed or a field is invalid (see `issues`).
401	`unauthorized`	No credentials, or the API key or session is invalid or revoked.
403	`forbidden`	The caller is authenticated but may not do this (wrong role, or an API key on a human-only endpoint).
500	`internal_error`	Something went wrong on Logu's side.