Create Challenge
Mints the challenge a browser needs to run a WebAuthn ceremony against the authenticated user’s own passkeys. A registration challenge enrolls a new passkey; a deletion challenge is bound to the one passkey named by passkey_id and proves the user still holds it. Challenges are single-use and expire 5 minutes after they are issued, so send a fresh Idempotency-Key per ceremony — a replayed key returns the original challenge, which may already have expired. Requires a user session.
Authorizations
An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.
Headers
A unique key that makes this request safe to retry. See Idempotent requests.
255"d9105228-4a08-46b1-8b91-42fed586d383"
Pins the request to a dated API version.
"2026-07-29-1"
Body
Response
challenge minted
The challenge to pass to the WebAuthn ceremony, base64url-encoded without padding.

