curl --request POST \
--url https://aropay.aro.media/api/v1/me/passkeys/register \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"credential": {}
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({credential: {}})
};
fetch('https://aropay.aro.media/api/v1/me/passkeys/register', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/me/passkeys/register"
payload = { "credential": {} }
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"passkey": {
"id": "<string>",
"deviceName": "<string>",
"transports": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z"
}
}
}{
"ok": false,
"error": {
"code": "passkey_verification_failed",
"message": "The credential could not be verified."
}
}{
"ok": false,
"error": {
"code": "invalid_api_key",
"message": "Invalid API key."
}
}{
"ok": false,
"error": {
"code": "session_required",
"message": "This action requires a browser session."
}
}{
"ok": false,
"error": {
"code": "passkey_exists",
"message": "This passkey is already registered."
}
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests. Try again shortly."
}
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "An unexpected error occurred."
}
}Register passkey
Session-only. Verify the authenticator’s attestation against the
challenge cookie (issued only after step-up by
POST /me/passkeys/options) and store the credential. The attestation
must carry user verification. Optionally name the device.
The challenge must come from this session at the account’s current
token version, and it is single-use: the first application/json
attempt spends it, even one that fails verification, so a retry
starts again from POST /me/passkeys/options (and its step-up). A
request with any other content type gets 415 and leaves the
challenge unspent. If a password change, admin reset or 2FA
enrolment commits while this request is being processed, nothing is
stored (409 account_changed).
curl --request POST \
--url https://aropay.aro.media/api/v1/me/passkeys/register \
--header 'Content-Type: application/json' \
--cookie aropay_session= \
--data '
{
"credential": {}
}
'const options = {
method: 'POST',
headers: {cookie: 'aropay_session=', 'Content-Type': 'application/json'},
body: JSON.stringify({credential: {}})
};
fetch('https://aropay.aro.media/api/v1/me/passkeys/register', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://aropay.aro.media/api/v1/me/passkeys/register"
payload = { "credential": {} }
headers = {
"cookie": "aropay_session=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"ok": true,
"data": {
"passkey": {
"id": "<string>",
"deviceName": "<string>",
"transports": [
"<string>"
],
"createdAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z"
}
}
}{
"ok": false,
"error": {
"code": "passkey_verification_failed",
"message": "The credential could not be verified."
}
}{
"ok": false,
"error": {
"code": "invalid_api_key",
"message": "Invalid API key."
}
}{
"ok": false,
"error": {
"code": "session_required",
"message": "This action requires a browser session."
}
}{
"ok": false,
"error": {
"code": "passkey_exists",
"message": "This passkey is already registered."
}
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests. Try again shortly."
}
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "An unexpected error occurred."
}
}Authorizations
Browser session cookie minted by POST /auth/login (or passkey
login). httpOnly, SameSite=Lax, 24 h TTL. Endpoints marked
Session-only accept only this credential and return
403 session_required for API keys.