Verify Passkey API

Verify Passkey endpoints exposed by the Devotel CPaaS API Base path: /api/v1/verify/passkey Endpoint count: 5

No dashboard screen — passkeys are driven from your own application. A WebAuthn passkey is registered and used where the end user is present: your app requests options from these endpoints, runs the browser ceremony (navigator.credentials.create() / .get(), or the @simplewebauthn/browser helper), and posts the resulting attestation or assertion back to the matching verify endpoint. The Orbit dashboard covers OTP send/check, profiles, and analytics — it does not enroll or revoke passkeys on a user’s behalf. Retire a lost or rotated key from your app with POST /verify/passkey/factors/{factorId}/revoke.

Worked ceremony sequence

The five endpoints on this page are one lifecycle. The samples below run them in operator order — registration options → browser ceremony → registration verify → login options + login verify → revoke — with the real wire shapes at each step. Every JSON envelope below is a worked copy of the response, not the autogenerated "data": {} hull. Hand the returned options object to the browser verbatim — never re-serialize or mutate fields — and use @simplewebauthn/browser to keep the base64url handling honest.

1. Enroll — registration options

POST /api/v1/verify/passkey/registration/options returns the PublicKeyCredentialCreationOptionsJSON and a challengeId you submit back with the attestation.

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "identity": "user_1a2b3c", "friendlyName": "Ada work laptop" }'

{
  "data": {
    "challengeId": "vpkchal_4e0f1a2b3c",
    "options": {
      "rp": { "name": "Devotel Verify", "id": "verify.devotel.io" },
      "challenge": "6yC5vB8nT2sF9kLq7wE4gHjP3vN1dQbX0aU6mA0xEI0",
      "user": { "id": "dXNlcj8xITBiMw", "name": "user_1a2b3c", "displayName": "Ada work laptop" },
      "pubKeyCredParams": [{ "type": "public-key", "alg": -7 }, { "type": "public-key", "alg": -257 }]
    },
    "expiresAt": "2026-08-30T10:05:00.000Z"
  },
  "meta": {
    "request_id": "req_pks_reg_opts_01",
    "timestamp": "2026-08-30T10:00:00.000Z"
  }
}

The options endpoints are rate-limited at 20 requests/minute per tenant.

2. Enroll — browser ceremony + attestation verify

In the browser, run the ceremony with the exact options payload from step 1, then POST the serialized credential back within the TTL (default 300s, capped at 600):

import { startRegistration } from '@simplewebauthn/browser'

const attestation = await startRegistration({ optionsJSON: options })

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "challengeId": "vpkchal_4e0f1a2b3c",
    "response": {
      "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
      "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
      "type": "public-key",
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2VixWE1dGhuLmNyZWF0ZSI...",
        "attestationObject": "o2NmbXRkbm9uZWE...",
        "transports": ["internal"]
      }
    }
  }'

{
  "data": {
    "challengeId": "vpkchal_4e0f1a2b3c",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "identity": "user_1a2b3c",
    "friendlyName": "Ada work laptop",
    "credentialId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "aaguid": "08987059-4f0d-4a36-9f51-7f2a4b9c1a30",
    "backupEligible": true,
    "backupState": true,
    "createdAt": "2026-08-30T10:01:30.000Z"
  },
  "meta": {
    "request_id": "req_pks_reg_verify_02",
    "timestamp": "2026-08-30T10:01:30.000Z"
  }
}

POST success returns 201 (not 200). backupEligible + backupState echo the authenticator’s BE/BS flags: false on backupEligible means the key lives on this one device — treat it accordingly. POST /api/v1/verify/passkey/authentication/options for the identity returns PublicKeyCredentialRequestOptionsJSON with that identity’s credentials hinted in allowCredentials:

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "identity": "user_1a2b3c", "ttlSeconds": 300 }'

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "options": {
      "rpId": "verify.devotel.io",
      "challenge": "aB3xJ7fQ1tV9oLwH2yZk8cP4rTn6mSsD0aG5bF3iU2",
      "allowCredentials": [
        { "type": "public-key", "id": "S3vB1c9m2Xq7wYh0kZ2n5A", "transports": ["internal"] }
      ],
      "userVerification": "preferred"
    },
    "expiresAt": "2026-08-30T10:05:00.000Z"
  },
  "meta": {
    "request_id": "req_pks_auth_opts_03",
    "timestamp": "2026-08-30T10:02:00.000Z"
  }
}

import { startAuthentication } from '@simplewebauthn/browser'

const assertion = await startAuthentication({ optionsJSON: options })

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "challengeId": "vpkchal_8c3d9e1f22",
    "response": {
      "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
      "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
      "type": "public-key",
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2VixWE1dGhuLmdldCI...",
        "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4...",
        "signature": "MEUCIQDq0uW2kLfTqZ7oJ0bN...",
        "userHandle": "dXNfcjFhMmI3Yw"
      }
    }
  }'

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "approvedAt": "2026-08-30T10:02:15.000Z",
    "cloningSuspected": false
  },
  "meta": {
    "request_id": "req_pks_auth_verify_04",
    "timestamp": "2026-08-30T10:02:15.000Z"
  }
}

On a passkey-counter regression — the W3C cloning signal — the factor is auto-revoked and the response carries cloningSuspected: true. The verify endpoints are rate-limited at 60 requests/minute per tenant.

5. Retire — revoke

POST /api/v1/verify/passkey/factors/{factorId}/revoke flips the factor to revoked. Idempotent — re-calling an already-revoked factor returns the same response:

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/vfpk_9d2e1c7b55/revoke" \
  -H "X-API-Key: dv_live_sk_your_key_here"

{
  "data": {
    "factorId": "vfpk_9d2e1c7b55",
    "status": "revoked"
  },
  "meta": {
    "request_id": "req_pks_revoke_05",
    "timestamp": "2026-08-30T10:05:00.000Z"
  }
}

After revocation, new login ceremonies against the factor are rejected with 409 / reason: "FACTOR_REVOKED".

Relying party and origin

WebAuthn binds every credential to a relying-party ID and an HTTPS origin, and the returned options payload carries both. The default RP is rpId: "verify.devotel.io" with origin https://verify.devotel.io.

Production apps on their own domain must be issued options whose rp.id is a registrable suffix of the page origin — browsers reject the ceremony otherwise, no network call ever fires. rpId must equal the origin’s host or be a parent domain of it (app.acme.com may use acme.com).
Local development: run on http://localhost — localhost is exempt from the HTTPS rule and ceremonies work there.
Never mutate the options object between the API response and the browser call; the attestation/assertion is bound to the exact challenge, RP ID, and origin inside it.

Server-side without an SDK helper

The Node SDK ships no typed passkey helper — walk the same ceremony server-side (test harnesses, CLI, CI smoke) with the generic orbit.request escape hatch:

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({ apiKey: process.env.ORBIT_API_KEY! })

const { data: reg } = await orbit.request<{
  challengeId: string
  options: object // PublicKeyCredentialCreationOptionsJSON
  expiresAt: string
}>('POST', '/api/v1/verify/passkey/registration/options', {
  data: { identity: 'user_1a2b3c', friendlyName: 'Ada work laptop' },
})

// hand `reg.options` to your browser/agent, collect the attestation, then:
const { data: factor } = await orbit.request<{
  challengeId: string
  factorId: string
  status: 'approved' | 'denied'
  credentialId: string
}>('POST', '/api/v1/verify/passkey/registration/verify', {
  data: { challengeId: reg.challengeId, response: attestation },
})

if (factor.status !== 'approved') {
  throw new Error(`passkey enrollment denied for ${factor.challengeId}`)
}

The browser ceremony step itself cannot move server-side — the authenticator lives with the user. Everything before and after it can.

Error surface

Failures arrive in the standard error envelope (meta.request_id included). Plan for these on the ceremony paths:

Status	`reason`	When it fires	Recovery
404	—	`challengeId`/factor unknown to this tenant	Re-issue `/options`; show a not-found state
409	`CHALLENGE_WRONG_TYPE`	registration challenge posted to the login verifier (or vice-versa)	Match the ceremony type to the verifier call
409	`CHALLENGE_TERMINAL`	challenge already used or denied	Challenges are single-use — re-issue `/options`
410	`CHALLENGE_EXPIRED`	attestation/assertion arrived after the TTL	Re-issue `/options` and retry the ceremony
409	`FACTOR_REVOKED`	login attempt on a revoked (or auto-revoked) factor	Route the user back through enrollment
422	`ATTESTATION_INVALID` / `ATTESTATION_UNVERIFIED`	RP/origin mismatch or corrupt attestation payload	Fix `rpId`/origin alignment; pass `options` through unmutated

A 422 on registration verify marks the challenge denied, so a malformed retry does not silently burn the pending ceremony — re-issue fresh options instead of looping on the same challengeId. Every passkey endpoint is authentication- and rate-limit-gated only — no extra scope — so issue dedicated keys for factor flows and restrict which callers can reach them. A factor created by one tenant is never visible to another.

Issue WebAuthn authentication options

POST /api/v1/verify/passkey/authentication/options

Returns PublicKeyCredentialRequestOptionsJSON the browser hands to navigator.credentials.get(). allowCredentials includes the identity’s registered passkeys with their transport hints.

string

Stripe-style idempotency token. Pass a stable, client-generated value (1-255 chars) to dedupe retries on transient timeouts. The same key+credential+path replays the original response for 24h on 2xx (5min on 4xx, 30s on 5xx). Returns 409 if a concurrent request with the same key is already in flight; replayed responses include the Idempotency-Replay: true response header.

string (enum: true|false)

Sandbox opt-in for Clerk-session-authenticated requests. Set to true to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response meta.test_mode: true. Ignored for live API keys (dv_live_sk_*) — server-to-server clients must use a test-prefixed key (dv_test_sk_*) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.

string

required

The end-user identifier whose registered passkeys should be offered for this authentication ceremony (1–255 characters).

integer

Lifetime of the returned authentication challenge, in seconds, before it expires. Defaults to 300 (5 minutes); range 30–600.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options", headers=headers, json={
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options", bytes.NewBuffer([]byte(`{
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "approvedAt": "2026-08-30T10:02:15.000Z",
    "cloningSuspected": false
  },
  "meta": {
    "request_id": "req_pks_auth_verify_04",
    "timestamp": "2026-08-30T10:02:15.000Z"
  }
}

Verify WebAuthn authentication assertion

POST /api/v1/verify/passkey/authentication/verify

Verifies the assertion returned by navigator.credentials.get(). On success bumps counter + lastUsedAt. Counter regression auto-revokes the factor (W3C WebAuthn L3 § 6.1.3 cloning signal).

string

string (enum: true|false)

string

required

The challengeId returned by POST /verify/passkey/authentication/options.

object

required

The AuthenticationResponseJSON returned by the browser’s navigator.credentials.get() (or @simplewebauthn/browser’s startAuthentication()), serialized to JSON.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify", headers=headers, json={
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify", bytes.NewBuffer([]byte(`{
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "approvedAt": "2026-08-30T10:02:15.000Z",
    "cloningSuspected": false
  },
  "meta": {
    "request_id": "req_pks_auth_verify_04",
    "timestamp": "2026-08-30T10:02:15.000Z"
  }
}

Revoke a passkey factor

POST /api/v1/verify/passkey/factors/{factorId}/revoke

Flips a passkey factor to revoked. Idempotent — a second call on an already-revoked factor returns the same response.

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke", headers=headers, json={})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke", bytes.NewBuffer([]byte(`{}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "approvedAt": "2026-08-30T10:02:15.000Z",
    "cloningSuspected": false
  },
  "meta": {
    "request_id": "req_pks_auth_verify_04",
    "timestamp": "2026-08-30T10:02:15.000Z"
  }
}

Issue WebAuthn registration options

POST /api/v1/verify/passkey/registration/options

Returns PublicKeyCredentialCreationOptionsJSON the browser hands to navigator.credentials.create(). The resulting attestation must be submitted to /verify/passkey/registration/verify within the TTL.

string

string (enum: true|false)

string

required

Stable identifier for the end user enrolling this passkey — your user id, email, or username (1–255 characters).

string

required

Human-readable label for the credential, shown in the operating-system prompt during enrollment (1–120 characters).

integer

Lifetime of the returned registration challenge, in seconds, before it expires. Defaults to 300 (5 minutes); range 30–600.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options", headers=headers, json={
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options", bytes.NewBuffer([]byte(`{
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "approvedAt": "2026-08-30T10:02:15.000Z",
    "cloningSuspected": false
  },
  "meta": {
    "request_id": "req_pks_auth_verify_04",
    "timestamp": "2026-08-30T10:02:15.000Z"
  }
}

Verify WebAuthn registration attestation

POST /api/v1/verify/passkey/registration/verify

Verifies the attestation returned by navigator.credentials.create(). On success creates a verify_passkey_factor row from the credential public key + counter + transports.

string

string (enum: true|false)

string

required

The challengeId returned by POST /verify/passkey/registration/options.

object

required

The RegistrationResponseJSON returned by the browser’s navigator.credentials.create() (or @simplewebauthn/browser’s startRegistration()), serialized to JSON.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify", headers=headers, json={
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify", bytes.NewBuffer([]byte(`{
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpkchal_8c3d9e1f22",
    "factorId": "vfpk_9d2e1c7b55",
    "status": "approved",
    "approvedAt": "2026-08-30T10:02:15.000Z",
    "cloningSuspected": false
  },
  "meta": {
    "request_id": "req_pks_auth_verify_04",
    "timestamp": "2026-08-30T10:02:15.000Z"
  }
}

API Reference

All Endpoints

Verify Passkey API

Verify Passkey API

Worked ceremony sequence

1. Enroll — registration options

2. Enroll — browser ceremony + attestation verify

5. Retire — revoke

Relying party and origin

Server-side without an SDK helper

Error surface

Issue WebAuthn authentication options

Verify WebAuthn authentication assertion

Revoke a passkey factor

Issue WebAuthn registration options

Verify WebAuthn registration attestation

​Verify Passkey API

​Worked ceremony sequence

​1. Enroll — registration options

​2. Enroll — browser ceremony + attestation verify

​3. Login — authentication options

​4. Login — browser ceremony + assertion verify

​5. Retire — revoke

​Relying party and origin

​Server-side without an SDK helper

​Error surface

​Issue WebAuthn authentication options

​Verify WebAuthn authentication assertion

​Revoke a passkey factor

​Issue WebAuthn registration options

​Verify WebAuthn registration attestation

Verify Passkey API

Worked ceremony sequence

1. Enroll — registration options

2. Enroll — browser ceremony + attestation verify

3. Login — authentication options

4. Login — browser ceremony + assertion verify

5. Retire — revoke

Relying party and origin

Server-side without an SDK helper

Error surface

Issue WebAuthn authentication options

Verify WebAuthn authentication assertion

Revoke a passkey factor

Issue WebAuthn registration options

Verify WebAuthn registration attestation