Finish a passkey login
Relays the browser’s assertion for the attempt the passkeyToken names and issues OAuth2 tokens, the same envelope as the password grant. The passkeyToken works once.
Failures:
403 AUT-1016— passkey sign-in is not enabled for the tenant of this e-mail.403 AUT-0021— the caller’s network is outside the tenant’s IP allowlist.401 AUT-1017— the sign-in could not be completed, whatever the reason. On begin, Caradhras refused to open the ceremony.429 AUT-1018— too many sign-in attempts for this e-mail (finish only).503 AUT-0028— the server has no MFA_SECRET, so passkey sign-in is unavailable. When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later.
Cuerpo
Respuesta
OK
The issued OAuth2 access token (JWT).
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"
Access token lifetime in seconds.
3600
The refresh token to obtain a new access token.
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"
The token type; always "Bearer".
"Bearer"
The OIDC ID token (JWT).
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"
Space-delimited scopes granted to the token.
"openid profile email"

