Complete passkey registration
curl --request POST \
--url https://api.pid.peridotvault.com/v1/credentials/register/finish \
--header 'Content-Type: application/json' \
--cookie pid_access= \
--data '
{
"registrationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"credential": {},
"approval": {}
}
'const options = {
method: 'POST',
headers: {cookie: 'pid_access=', 'Content-Type': 'application/json'},
body: JSON.stringify({
registrationId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
credential: {},
approval: {}
})
};
fetch('https://api.pid.peridotvault.com/v1/credentials/register/finish', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.pid.peridotvault.com/v1/credentials/register/finish"
payload = {
"registrationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"credential": {},
"approval": {}
}
headers = {
"cookie": "pid_access=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.pid.peridotvault.com/v1/credentials/register/finish"
payload := strings.NewReader("{\n \"registrationId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"credential\": {},\n \"approval\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "pid_access=")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"type": "secp256r1",
"credentialId": "<string>",
"publicKey": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z"
}{
"statusCode": 400,
"message": [
"handle must be 3-20 chars: lowercase letters, numbers, underscore"
]
}{
"statusCode": 401,
"message": "Unauthorized"
}{
"statusCode": 429,
"message": "ThrottlerException: Too Many Requests"
}credentials
Complete passkey registration
Verifies the WebAuthn attestation against the single-use, expiring challenge and stores the public key + credential ID (public material only). Rejects a second credential without a valid existing-credential approval, a replayed challenge, or a duplicated credential ID.
POST
/
credentials
/
register
/
finish
Complete passkey registration
curl --request POST \
--url https://api.pid.peridotvault.com/v1/credentials/register/finish \
--header 'Content-Type: application/json' \
--cookie pid_access= \
--data '
{
"registrationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"credential": {},
"approval": {}
}
'const options = {
method: 'POST',
headers: {cookie: 'pid_access=', 'Content-Type': 'application/json'},
body: JSON.stringify({
registrationId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
credential: {},
approval: {}
})
};
fetch('https://api.pid.peridotvault.com/v1/credentials/register/finish', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.pid.peridotvault.com/v1/credentials/register/finish"
payload = {
"registrationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"credential": {},
"approval": {}
}
headers = {
"cookie": "pid_access=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.pid.peridotvault.com/v1/credentials/register/finish"
payload := strings.NewReader("{\n \"registrationId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"credential\": {},\n \"approval\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "pid_access=")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"type": "secp256r1",
"credentialId": "<string>",
"publicKey": "<string>",
"createdAt": "2023-11-07T05:31:56Z",
"lastUsedAt": "2023-11-07T05:31:56Z"
}{
"statusCode": 400,
"message": [
"handle must be 3-20 chars: lowercase letters, numbers, underscore"
]
}{
"statusCode": 401,
"message": "Unauthorized"
}{
"statusCode": 429,
"message": "ThrottlerException: Too Many Requests"
}Authorizations
JWT access token set by /auth/google/callback or /auth/refresh
Body
application/json
Response
The registered authority
Passkey authority model (secp256r1 owner passkey)
Available options:
secp256r1 WebAuthn credential ID — public data
33-byte compressed secp256r1 public key, base64url — the on-chain smart-account authority