Begin a passkey login
Resolves the tenant of the e-mail and answers the WebAuthn request options for navigator.credentials.get, with a passkeyToken naming this attempt for 5 minutes.
Failures:
403 AUT-1016— passkey sign-in is not enabled for the tenant of this e-mail.403 AUT-0021— the caller’s network is outside the tenant’s IP allowlist.401 AUT-1017— the sign-in could not be completed, whatever the reason. On begin, Caradhras refused to open the ceremony.429 AUT-1018— too many sign-in attempts for this e-mail (finish only).503 AUT-0028— the server has no MFA_SECRET, so passkey sign-in is unavailable. When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later.
POST
Begin a passkey login
Body
application/json
The e-mail of the person signing in. The tenant is resolved from it.
Required string length:
3 - 254Example:
"ana@acme.com"
Response
OK
The WebAuthn request options (publicKey) to pass to navigator.credentials.get, exactly as the identity provider wrote them.
Short-lived token naming this login attempt. Send it back to /v1/login/passkey/finish within 5 minutes; it works once.
Example:
"eyJhbGciOiJIUzI1NiJ9..."

