Passkeys

Verify passkey login

POST/api/v1/auth/passkey/login/verify

Completes passkey sign-in using the browser's WebAuthn assertion response.

No authentication required

Credential check — tight, feeds automatic IP blocking

Body parameters

`email`stringrequired	Account email address.
`challengeId`stringrequired	challengeId from POST /passkey/login/options.
`response`objectrequired	The WebAuthn assertion response object from navigator.credentials.get().
`deviceName`string	Human-readable device label for the new session.
`locale`string	en or fr.

Notes

If two-factor authentication is also enabled, the response is { requiresTotp: true, pendingToken } instead.

Request

curl --request POST \
  --url https://api.swiftgoma.com/api/v1/auth/passkey/login/verify \
  --header 'Content-Type: application/json' \
  --data '{
  "email": "aline@example.com",
  "challengeId": "8f1b2c3d-4e5f-6789-a0b1-c2d3e4f56789",
  "response": {
    "id": "cred-id-base64url",
    "rawId": "cred-id-base64url",
    "type": "public-key"
  },
  "deviceName": "Chrome on macOS",
  "locale": "fr"
}'

200Example response

{
  "success": true,
  "data": {
    "user": {
      "id": "3f2a1c9e-7b41-4e2a-9c31-8e6b2d4f10aa",
      "name": "Aline Mapendo",
      "role": "BUYER",
      "email": "aline@example.com",
      "isEmailVerified": true,
      "phone": "243812345678",
      "isPhoneVerified": false,
      "createdAt": "2026-01-14T10:32:00.000Z"
    }
  }
}