WebAuthn Credential Management

Endpoints for managing WebAuthn credentials

List User Credentials

cURL

curl -X GET "https://your-domain.com/recipe/webauthn/user/credential/list?recipeUserId=recipe-user-id" \
  -H "Content-Type: application/json"

200 OK

{
  "status": "OK",
  "credentials": [
    {
      "credentialId": "credential-id-1",
      "publicKey": "base64-public-key",
      "counter": 1,
      "transports": ["usb", "nfc"],
      "createdAt": 1234567890000
    },
    {
      "credentialId": "credential-id-2",
      "publicKey": "base64-public-key",
      "counter": 5,
      "transports": ["internal"],
      "createdAt": 1234567900000
    }
  ]
}

recipeUserId · string · required

The recipe user ID to list credentials for

status · string

“OK”

credentials · array

Array of credential objects for this user

credentials[].credentialId · string

Unique identifier for the credential

credentials[].publicKey · string

Base64-encoded public key

credentials[].counter · number

Signature counter value (for replay detection)

credentials[].transports · array

Supported transport methods (e.g., “usb”, “nfc”, “ble”, “internal”)

credentials[].createdAt · number

Timestamp when credential was created (milliseconds since epoch)

---

Get Specific Credential

cURL

curl -X GET "https://your-domain.com/recipe/webauthn/user/credential/?recipeUserId=recipe-user-id&webauthnCredentialId=credential-id" \
  -H "Content-Type: application/json"

200 OK

{
  "status": "OK",
  "credentialId": "credential-id",
  "publicKey": "base64-public-key",
  "counter": 1,
  "transports": ["usb", "nfc"],
  "createdAt": 1234567890000
}

recipeUserId · string · required

The recipe user ID

webauthnCredentialId · string · required

The credential ID to retrieve

status · string

“OK” or “CREDENTIAL_NOT_FOUND_ERROR”

credentialId · string

Unique identifier for the credential

publicKey · string

Base64-encoded public key

counter · number

Signature counter value

transports · array

Supported transport methods

createdAt · number

Timestamp when credential was created

---

Remove Credential

cURL

curl -X DELETE "https://your-domain.com/recipe/webauthn/user/credential/remove?recipeUserId=recipe-user-id&webauthnCredentialId=credential-id" \
  -H "Content-Type: application/json"

200 OK

{
  "status": "OK"
}

recipeUserId · string · required

The recipe user ID

webauthnCredentialId · string · required

The credential ID to remove

status · string

“OK” or “CREDENTIAL_NOT_FOUND_ERROR”