Skip to main content
POST
Create Challenge

Authorizations

Authorization
string
header
required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Idempotency-Key
string

A unique key that makes this request safe to retry. See Idempotent requests.

Maximum string length: 255
Example:

"d9105228-4a08-46b1-8b91-42fed586d383"

Api-Version-Date
string

Pins the request to a dated API version.

Example:

"2026-07-29-1"

Body

application/json
challenge_type
enum<string>
required

The ceremony this challenge is for.

Available options:
registration,
deletion
passkey_id
string

The passkey the ceremony targets, prefixed wcred_. Required when challenge_type is deletion, ignored otherwise.

Response

challenge minted

challenge
string
required

The challenge to pass to the WebAuthn ceremony, base64url-encoded without padding.