> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Finish a passkey login > Relays the browser's assertion for the attempt the passkeyToken names and issues OAuth2 tokens, the same envelope as the password grant. The passkeyToken works once. Failures: - `403 AUT-1016` — passkey sign-in is not enabled for the tenant of this e-mail. - `403 AUT-0021` — the caller's network is outside the tenant's IP allowlist. - `401 AUT-1017` — the sign-in could not be completed, whatever the reason. On begin, Caradhras refused to open the ceremony. - `429 AUT-1018` — too many sign-in attempts for this e-mail (finish only). - `503 AUT-0028` — the server has no MFA_SECRET, so passkey sign-in is unavailable. When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later. ## OpenAPI ````yaml /pt/openapi/v3-current/AM-auth.yaml post /v1/login/passkey/finish openapi: 3.1.0 info: contact: name: Lerian Studio url: https://lerian.studio description: OpenAPI 3.1 surface for the Access Manager auth component. license: name: Lerian Studio General License title: Plugin Access Manager — Auth API version: v1 servers: - url: https://auth.sandbox.lerian.net security: [] tags: - description: >- OAuth2 token issuance: request an access token, refresh it, and log out. Public issuer endpoints. name: OAuth - description: >- Single sign-on through the tenant's identity provider: discover how an email signs in, then start the login. Public, called by the browser before login. name: SSO - description: >- Multi-factor authentication challenge and verification during the login flow. Public (identity is carried by the MFA token, not a Bearer token). name: MFA - description: >- Token-secured routes: enforce a permission, list the caller's permissions, and fetch OIDC user info. Require a Bearer token, validated in the use case. name: User Permission paths: /v1/login/passkey/finish: post: tags: - Passkey summary: Finish a passkey login description: >- Relays the browser's assertion for the attempt the passkeyToken names and issues OAuth2 tokens, the same envelope as the password grant. The passkeyToken works once. Failures: - `403 AUT-1016` — passkey sign-in is not enabled for the tenant of this e-mail. - `403 AUT-0021` — the caller's network is outside the tenant's IP allowlist. - `401 AUT-1017` — the sign-in could not be completed, whatever the reason. On begin, Caradhras refused to open the ceremony. - `429 AUT-1018` — too many sign-in attempts for this e-mail (finish only). - `503 AUT-0028` — the server has no MFA_SECRET, so passkey sign-in is unavailable. When the authorization server cannot be reached, is too slow to answer, or is failing, the answer is 503 AUT-0033: nothing about the request was wrong, and it may be retried later. operationId: finishPasskeyLogin requestBody: content: application/json: schema: $ref: '#/components/schemas/PasskeyFinishInput' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/OAuth2Token' description: OK '401': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unauthorized '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Forbidden '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '429': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error components: schemas: PasskeyFinishInput: additionalProperties: false properties: assertion: description: >- The PublicKeyCredential navigator.credentials.get returned, serialized as JSON (PublicKeyCredential.toJSON()). passkeyToken: description: The passkeyToken /v1/login/passkey/begin answered. examples: - eyJhbGciOiJIUzI1NiJ9... minLength: 1 type: string required: - passkeyToken - assertion type: object OAuth2Token: additionalProperties: false properties: accessToken: description: The issued OAuth2 access token (JWT). examples: - >- eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ type: string expiresIn: description: Access token lifetime in seconds. examples: - 3600 format: int64 type: integer idToken: description: The OIDC ID token (JWT). examples: - >- eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ type: string refreshToken: description: The refresh token to obtain a new access token. examples: - >- eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ type: string scope: description: Space-delimited scopes granted to the token. examples: - openid profile email type: string tokenType: description: The token type; always "Bearer". examples: - Bearer type: string required: - accessToken - tokenType - expiresIn - refreshToken type: object Detail: additionalProperties: true properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.