# Passkeys · Customer API

> Customer API reference for passkeys: GET /passkeys, POST /passkeys/register/options, POST /passkeys/register, DELETE /passkeys/{id}.

> Markdown version of https://kanorio.com/en/developers/customer-api/passkeys. Append `.md` to any developer docs URL for this format. Index: https://kanorio.com/llms.txt · MCP: https://app.kanorio.com/api/mcp

Base URL: `https://{site}/api/v1/customer` · [Errors](https://kanorio.com/en/developers/basics/errors) · [Pagination](https://kanorio.com/en/developers/basics/pagination)

### List the customer's passkeys

`GET /passkeys`

- Stability: beta

**Response** (200)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `passkeys` | object[] | yes | — |
| `passkeys[].id` | string | yes | — |
| `passkeys[].name` | string | yes | — |
| `passkeys[].backedUp` | boolean | yes | — |
| `passkeys[].createdAt` | string | yes | — |
| `passkeys[].lastUsedAt` | string \| null | yes | — |
| `passkeys[].stale` | boolean | yes | Bound to a previous primary domain; no longer usable on this site. |

```bash
curl -X GET "https://{site}/api/v1/customer/passkeys" \
  -H "Authorization: Bearer $KANORIO_CUSTOMER_TOKEN"
```

### Get WebAuthn creation options to add a passkey

`POST /passkeys/register/options`

- Stability: beta

**Request body**

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `origin` | string | no | Origin the WebAuthn ceremony runs on. Only `localhost` origins are honoured; production always uses the site's primary domain. |

**Response** (200)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `options` | object | yes | `PublicKeyCredentialCreationOptionsJSON` for `navigator.credentials.create()`. |

**Errors**

| Code | Status | When |
| --- | --- | --- |
| `METHOD_DISABLED` | 422 | — |
| `LIMIT_REACHED` | 403 | — |
| `RATE_LIMITED` | 429 | — |

```bash
curl -X POST "https://{site}/api/v1/customer/passkeys/register/options" \
  -H "Authorization: Bearer $KANORIO_CUSTOMER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### Verify a WebAuthn registration and save the passkey

`POST /passkeys/register`

- Stability: beta

**Request body**

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `response` | object | yes | `RegistrationResponseJSON` from the browser. |
| `name` | string | no | Label shown to the customer; defaults to the device and browser. |

**Response** (200)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `passkey` | object | yes | — |
| `passkey.id` | string | yes | — |
| `passkey.name` | string | yes | — |
| `passkey.backedUp` | boolean | yes | — |
| `passkey.createdAt` | string | yes | — |
| `passkey.lastUsedAt` | string \| null | yes | — |
| `passkey.stale` | boolean | yes | Bound to a previous primary domain; no longer usable on this site. |

**Errors**

| Code | Status | When |
| --- | --- | --- |
| `VERIFY_FAILED` | 422 | — |
| `CHALLENGE_EXPIRED` | 422 | — |
| `ALREADY_REGISTERED` | 422 | — |
| `LIMIT_REACHED` | 403 | — |

```bash
curl -X POST "https://{site}/api/v1/customer/passkeys/register" \
  -H "Authorization: Bearer $KANORIO_CUSTOMER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### Remove one of the customer's passkeys

`DELETE /passkeys/{id}`

- Stability: beta

**Parameters**

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes | — |

**Errors**

| Code | Status | When |
| --- | --- | --- |
| `NOT_FOUND` | 404 | — |

```bash
curl -X DELETE "https://{site}/api/v1/customer/passkeys/{id}" \
  -H "Authorization: Bearer $KANORIO_CUSTOMER_TOKEN"
```