Verify Passkey API

Verify Passkey endpoints exposed by the Devotel CPaaS API Base path: /api/v1/verify/passkey Endpoint count: 5

title: “WebAuthn passkey verify endpoints and browser ceremony” description: “Curated note on driving WebAuthn passkey registration and assertion from your own app, including relying party setup and factor revocation.”

No dashboard screen — passkeys are driven from your own application. A WebAuthn passkey is registered and used where the end user is present: your app requests options from these endpoints, runs the browser ceremony (navigator.credentials.create() / .get(), or the @simplewebauthn/browser helper), and posts the resulting attestation or assertion back to the matching verify endpoint. Set the relying party (rpId and origin) to your own domain. The Orbit dashboard covers OTP send/check, profiles, and analytics — it does not enroll or revoke passkeys on a user’s behalf. Retire a lost or rotated key from your app with POST /verify/passkey/factors/{factorId}/revoke.

Issue WebAuthn authentication options

POST /api/v1/verify/passkey/authentication/options

Returns PublicKeyCredentialRequestOptionsJSON the browser hands to navigator.credentials.get(). allowCredentials includes the identity’s registered passkeys with their transport hints.

string

required

The end-user identifier whose registered passkeys should be offered for this authentication ceremony (1–255 characters).

integer

Lifetime of the returned authentication challenge, in seconds, before it expires. Defaults to 300 (5 minutes); range 30–600.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options", headers=headers, json={
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options", bytes.NewBuffer([]byte(`{
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "identity": "user_1a2b3c",
  "ttlSeconds": 300
}
JSON);
echo curl_exec($ch);

{
  "data": {},
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Verify WebAuthn authentication assertion

POST /api/v1/verify/passkey/authentication/verify

Verifies the assertion returned by navigator.credentials.get(). On success bumps counter + lastUsedAt. Counter regression auto-revokes the factor (W3C WebAuthn L3 § 6.1.3 cloning signal).

string

required

The challengeId returned by POST /verify/passkey/authentication/options.

object

required

The AuthenticationResponseJSON returned by the browser’s navigator.credentials.get() (or @simplewebauthn/browser’s startAuthentication()), serialized to JSON.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify", headers=headers, json={
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify", bytes.NewBuffer([]byte(`{
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "challengeId": "vpkchal_3a7b2e1c9d4f5081",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
      "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
      "signature": "MEUCIQDx8s0m1Yv2p...",
      "userHandle": "dXNlcl8xYTJiM2M"
    }
  }
}
JSON);
echo curl_exec($ch);

{
  "data": {},
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Revoke a passkey factor

POST /api/v1/verify/passkey/factors/{factorId}/revoke

Flips a passkey factor to revoked. Idempotent — a second call on an already-revoked factor returns the same response.

string

required

—

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke", headers=headers, json={})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke", bytes.NewBuffer([]byte(`{}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{}
JSON);
echo curl_exec($ch);

{
  "data": {},
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Issue WebAuthn registration options

POST /api/v1/verify/passkey/registration/options

Returns PublicKeyCredentialCreationOptionsJSON the browser hands to navigator.credentials.create(). The resulting attestation must be submitted to /verify/passkey/registration/verify within the TTL.

string

required

Stable identifier for the end user enrolling this passkey — your user id, email, or username (1–255 characters).

string

required

Human-readable label for the credential, shown in the operating-system prompt during enrollment (1–120 characters).

integer

Lifetime of the returned registration challenge, in seconds, before it expires. Defaults to 300 (5 minutes); range 30–600.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options", headers=headers, json={
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options", bytes.NewBuffer([]byte(`{
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "identity": "user_1a2b3c",
  "friendlyName": "Ada Lovelace",
  "ttlSeconds": 300
}
JSON);
echo curl_exec($ch);

{
  "data": {},
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Verify WebAuthn registration attestation

POST /api/v1/verify/passkey/registration/verify

Verifies the attestation returned by navigator.credentials.create(). On success creates a verify_passkey_factor row from the credential public key + counter + transports.

string

required

The challengeId returned by POST /verify/passkey/registration/options.

object

required

The RegistrationResponseJSON returned by the browser’s navigator.credentials.create() (or @simplewebauthn/browser’s startRegistration()), serialized to JSON.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify", headers=headers, json={
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify", bytes.NewBuffer([]byte(`{
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
  "response": {
    "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
    "type": "public-key",
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
      "transports": [
        "internal",
        "hybrid"
      ]
    }
  }
}
JSON);
echo curl_exec($ch);

{
  "data": {},
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

API Reference

All Endpoints

Verify Passkey API

Verify Passkey API

title: “WebAuthn passkey verify endpoints and browser ceremony” description: “Curated note on driving WebAuthn passkey registration and assertion from your own app, including relying party setup and factor revocation.”

Issue WebAuthn authentication options

Verify WebAuthn authentication assertion

Revoke a passkey factor

Issue WebAuthn registration options

Verify WebAuthn registration attestation

​Verify Passkey API

​title: “WebAuthn passkey verify endpoints and browser ceremony” description: “Curated note on driving WebAuthn passkey registration and assertion from your own app, including relying party setup and factor revocation.”

​Issue WebAuthn authentication options

​Verify WebAuthn authentication assertion

​Revoke a passkey factor

​Issue WebAuthn registration options

​Verify WebAuthn registration attestation

Verify Passkey API

title: “WebAuthn passkey verify endpoints and browser ceremony” description: “Curated note on driving WebAuthn passkey registration and assertion from your own app, including relying party setup and factor revocation.”

Issue WebAuthn authentication options

Verify WebAuthn authentication assertion

Revoke a passkey factor

Issue WebAuthn registration options

Verify WebAuthn registration attestation