> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify Passkey API

> Verify Passkey endpoints exposed by the Devotel CPaaS API

# Verify Passkey API

Verify Passkey endpoints exposed by the Devotel CPaaS API

**Base path:** `/api/v1/verify/passkey`

**Endpoint count:** 5

<Note>
  **No dashboard screen — passkeys are driven from your own application.** A
  WebAuthn passkey is registered and used where the end user is present: your app
  requests options from these endpoints, runs the browser ceremony
  (`navigator.credentials.create()` / `.get()`, or the
  [`@simplewebauthn/browser`](https://simplewebauthn.dev) helper), and posts the
  resulting attestation or assertion back to the matching `verify` endpoint. Set
  the relying party (`rpId` and origin) to your own domain. The Orbit dashboard
  covers OTP send/check, profiles, and analytics — it does not enroll or revoke
  passkeys on a user's behalf. Retire a lost or rotated key from your app with
  `POST /verify/passkey/factors/{factorId}/revoke`.
</Note>

***

### Issue WebAuthn authentication options

<Note>
  `POST /api/v1/verify/passkey/authentication/options`
</Note>

Returns PublicKeyCredentialRequestOptionsJSON the browser hands to navigator.credentials.get(). allowCredentials includes the identity's registered passkeys with their transport hints.

<ParamField body="identity" type="string" required>
  The end-user identifier whose registered passkeys should be offered for this authentication ceremony (1–255 characters).
</ParamField>

<ParamField body="ttlSeconds" type="integer">
  Lifetime of the returned authentication challenge, in seconds, before it expires. Defaults to 300 (5 minutes); range 30–600.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options" \
      -H "X-API-Key: dv_live_sk_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{
      "identity": "user_1a2b3c",
      "ttlSeconds": 300
    }'
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel/orbit-sdk'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options', {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
      "identity": "user_1a2b3c",
      "ttlSeconds": 300
    }),
    })
    console.log(await res.json())
    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    headers["Content-Type"] = "application/json"
    r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options", headers=headers, json={
      "identity": "user_1a2b3c",
      "ttlSeconds": 300
    })
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options", bytes.NewBuffer([]byte(`{
      "identity": "user_1a2b3c",
      "ttlSeconds": 300
    }`)))
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
    	req.Header.Set("Content-Type", "application/json")
    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options')
    req = Net::HTTP::Post.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']
    req['Content-Type'] = 'application/json'
    req.body = {
      "identity": "user_1a2b3c",
      "ttlSeconds": 300
    }.to_json
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/options');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),
      'Content-Type: application/json',
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
    {
      "identity": "user_1a2b3c",
      "ttlSeconds": 300
    }
    JSON);
    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

***

### Verify WebAuthn authentication assertion

<Note>
  `POST /api/v1/verify/passkey/authentication/verify`
</Note>

Verifies the assertion returned by navigator.credentials.get(). On success bumps counter + lastUsedAt. Counter regression auto-revokes the factor (W3C WebAuthn L3 § 6.1.3 cloning signal).

<ParamField body="challengeId" type="string" required>
  The `challengeId` returned by `POST /verify/passkey/authentication/options`.
</ParamField>

<ParamField body="response" type="object" required>
  The `AuthenticationResponseJSON` returned by the browser's `navigator.credentials.get()` (or `@simplewebauthn/browser`'s `startAuthentication()`), serialized to JSON.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify" \
      -H "X-API-Key: dv_live_sk_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{
      "challengeId": "vpkchal_3a7b2e1c9d4f5081",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
          "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
          "signature": "MEUCIQDx8s0m1Yv2p...",
          "userHandle": "dXNlcl8xYTJiM2M"
        }
      }
    }'
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel/orbit-sdk'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify', {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
      "challengeId": "vpkchal_3a7b2e1c9d4f5081",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
          "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
          "signature": "MEUCIQDx8s0m1Yv2p...",
          "userHandle": "dXNlcl8xYTJiM2M"
        }
      }
    }),
    })
    console.log(await res.json())
    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    headers["Content-Type"] = "application/json"
    r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify", headers=headers, json={
      "challengeId": "vpkchal_3a7b2e1c9d4f5081",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
          "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
          "signature": "MEUCIQDx8s0m1Yv2p...",
          "userHandle": "dXNlcl8xYTJiM2M"
        }
      }
    })
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify", bytes.NewBuffer([]byte(`{
      "challengeId": "vpkchal_3a7b2e1c9d4f5081",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
          "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
          "signature": "MEUCIQDx8s0m1Yv2p...",
          "userHandle": "dXNlcl8xYTJiM2M"
        }
      }
    }`)))
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
    	req.Header.Set("Content-Type", "application/json")
    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify')
    req = Net::HTTP::Post.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']
    req['Content-Type'] = 'application/json'
    req.body = {
      "challengeId": "vpkchal_3a7b2e1c9d4f5081",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
          "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
          "signature": "MEUCIQDx8s0m1Yv2p...",
          "userHandle": "dXNlcl8xYTJiM2M"
        }
      }
    }.to_json
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/authentication/verify');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),
      'Content-Type: application/json',
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
    {
      "challengeId": "vpkchal_3a7b2e1c9d4f5081",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi...",
          "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MdAAAAAA...",
          "signature": "MEUCIQDx8s0m1Yv2p...",
          "userHandle": "dXNlcl8xYTJiM2M"
        }
      }
    }
    JSON);
    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

***

### Revoke a passkey factor

<Note>
  `POST /api/v1/verify/passkey/factors/{factorId}/revoke`
</Note>

Flips a passkey factor to `revoked`. Idempotent — a second call on an already-revoked factor returns the same response.

<ParamField path="factorId" type="string" required>
  —
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke" \
      -H "X-API-Key: dv_live_sk_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{}'
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel/orbit-sdk'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke', {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({}),
    })
    console.log(await res.json())
    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    headers["Content-Type"] = "application/json"
    r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke", headers=headers, json={})
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke", bytes.NewBuffer([]byte(`{}`)))
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
    	req.Header.Set("Content-Type", "application/json")
    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke')
    req = Net::HTTP::Post.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']
    req['Content-Type'] = 'application/json'
    req.body = {}.to_json
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/factors/{factorId}/revoke');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),
      'Content-Type: application/json',
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
    {}
    JSON);
    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

***

### Issue WebAuthn registration options

<Note>
  `POST /api/v1/verify/passkey/registration/options`
</Note>

Returns PublicKeyCredentialCreationOptionsJSON the browser hands to navigator.credentials.create(). The resulting attestation must be submitted to /verify/passkey/registration/verify within the TTL.

<ParamField body="identity" type="string" required>
  Stable identifier for the end user enrolling this passkey — your user id, email, or username (1–255 characters).
</ParamField>

<ParamField body="friendlyName" type="string" required>
  Human-readable label for the credential, shown in the operating-system prompt during enrollment (1–120 characters).
</ParamField>

<ParamField body="ttlSeconds" type="integer">
  Lifetime of the returned registration challenge, in seconds, before it expires. Defaults to 300 (5 minutes); range 30–600.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options" \
      -H "X-API-Key: dv_live_sk_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{
      "identity": "user_1a2b3c",
      "friendlyName": "Ada Lovelace",
      "ttlSeconds": 300
    }'
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel/orbit-sdk'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options', {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
      "identity": "user_1a2b3c",
      "friendlyName": "Ada Lovelace",
      "ttlSeconds": 300
    }),
    })
    console.log(await res.json())
    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    headers["Content-Type"] = "application/json"
    r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options", headers=headers, json={
      "identity": "user_1a2b3c",
      "friendlyName": "Ada Lovelace",
      "ttlSeconds": 300
    })
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options", bytes.NewBuffer([]byte(`{
      "identity": "user_1a2b3c",
      "friendlyName": "Ada Lovelace",
      "ttlSeconds": 300
    }`)))
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
    	req.Header.Set("Content-Type", "application/json")
    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options')
    req = Net::HTTP::Post.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']
    req['Content-Type'] = 'application/json'
    req.body = {
      "identity": "user_1a2b3c",
      "friendlyName": "Ada Lovelace",
      "ttlSeconds": 300
    }.to_json
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/options');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),
      'Content-Type: application/json',
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
    {
      "identity": "user_1a2b3c",
      "friendlyName": "Ada Lovelace",
      "ttlSeconds": 300
    }
    JSON);
    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

***

### Verify WebAuthn registration attestation

<Note>
  `POST /api/v1/verify/passkey/registration/verify`
</Note>

Verifies the attestation returned by navigator.credentials.create(). On success creates a verify\_passkey\_factor row from the credential public key + counter + transports.

<ParamField body="challengeId" type="string" required>
  The `challengeId` returned by `POST /verify/passkey/registration/options`.
</ParamField>

<ParamField body="response" type="object" required>
  The `RegistrationResponseJSON` returned by the browser's `navigator.credentials.create()` (or `@simplewebauthn/browser`'s `startRegistration()`), serialized to JSON.
</ParamField>

<RequestExample>
  <CodeGroup>
    ```bash cURL theme={null}
    curl -X POST "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify" \
      -H "X-API-Key: dv_live_sk_your_key_here" \
      -H "Content-Type: application/json" \
      -d '{
      "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
          "transports": [
            "internal",
            "hybrid"
          ]
        }
      }
    }'
    ```

    ```typescript Node.js theme={null}
    import { Orbit } from '@devotel/orbit-sdk'

    const orbit = new Orbit({
      apiKey: process.env.ORBIT_API_KEY!,
    })

    const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify', {
      method: 'POST',
      headers: {
        'X-API-Key': process.env.ORBIT_API_KEY!,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
      "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
          "transports": [
            "internal",
            "hybrid"
          ]
        }
      }
    }),
    })
    console.log(await res.json())
    ```

    ```python Python theme={null}
    import os, requests

    headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
    headers["Content-Type"] = "application/json"
    r = requests.post("https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify", headers=headers, json={
      "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
          "transports": [
            "internal",
            "hybrid"
          ]
        }
      }
    })
    print(r.json())
    ```

    ```go Go theme={null}
    package main

    import (
    	"bytes"
    	"net/http"
    	"os"
    )

    func main() {
    	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify", bytes.NewBuffer([]byte(`{
      "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
          "transports": [
            "internal",
            "hybrid"
          ]
        }
      }
    }`)))
    	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
    	req.Header.Set("Content-Type", "application/json")
    	http.DefaultClient.Do(req)
    }
    ```

    ```ruby Ruby theme={null}
    require 'net/http'
    require 'json'

    uri = URI('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify')
    req = Net::HTTP::Post.new(uri)
    req['X-API-Key'] = ENV['ORBIT_API_KEY']
    req['Content-Type'] = 'application/json'
    req.body = {
      "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
          "transports": [
            "internal",
            "hybrid"
          ]
        }
      }
    }.to_json
    res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
    puts res.body
    ```

    ```php PHP theme={null}
    <?php
    $ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/passkey/registration/verify');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
      'X-API-Key: ' . getenv('ORBIT_API_KEY'),
      'Content-Type: application/json',
    ]);
    curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
    {
      "challengeId": "vpkchal_9f2c1d7a8b3e4f60",
      "response": {
        "id": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "rawId": "S3vB1c9m2Xq7wYh0kZ2n5A",
        "type": "public-key",
        "authenticatorAttachment": "platform",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwi...",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjE...",
          "transports": [
            "internal",
            "hybrid"
          ]
        }
      }
    }
    JSON);
    echo curl_exec($ch);
    ```
  </CodeGroup>
</RequestExample>

***