Hanko webauthn API declares
1 security scheme
for authenticating requests.
It accepts HTTP bearer tokens (API Key) (BearerApiKeyAuth).
BearerApiKeyAuth — Bearer authentication header of the form Bearer , where is your API key. Must only be used when using Hanko Cloud.
Paths & Operations 8
Across 7 paths, the API surfaces 8 operations — 1 DELETE, 2 GET, 1 PATCH, 4 POST. Each is listed below with its method, path, parameters, and response codes.
webauthn 8
Represents all objects which are related to WebAuthn in common
GET
/{tenant_id}/.well-known/jwks.json
Well-known JWKS
get-.well-known-jwks.json1 param→ 200
POST
/webauthn/login/initializedeprecated
Initialize WebAuthn login
webauthnLoginInitbody→ 200400500
POST
/webauthn/login/finalizedeprecated
Finalize WebAuthn login
webauthnLoginFinalbody→ 200400401500
POST
/webauthn/registration/initializedeprecated
Initialize WebAuthn registration
webauthnRegInit→ 200400422500
POST
/webauthn/registration/finalizedeprecated
Finalize WebAuthn registration
webauthnRegFinalbody→ 200400500
GET
/webauthn/credentialsdeprecated
Get a list of WebAuthn credentials
listCredentials→ 200401500
PATCH
/webauthn/credentials/{id}deprecated
Updates a WebAuthn credential
updateCredential1 parambody→ 200400401404500
DELETE
/webauthn/credentials/{id}deprecated
Deletes a WebAuthn credential
deleteCredential1 param→ 201400401404500
Schemas 12
The contract defines 12 schemas that model the data the API accepts and returns. The most detailed are WebauthnCredential (11 properties), PublicKeyCredentialAttestationResponse (4 properties), PublicKeyCredentialAssertionResponse (4 properties), WebauthnLoginResponse (2 properties). Each schema is shown below with its type and property counts.
CookieSession
string
Value is a [JSON Web Token](https://www.rfc-editor.org/rfc/rfc7519.html)
PublicKeyCredentialAssertionResponse
object
WebAuthn API response to a navigator.credentials.get() call
4 properties
CredentialCreationOptions
object
Options for credential creation with the WebAuthn API
1 property
PublicKeyCredentialAttestationResponse
object
WebAuthn API response to a navigator.credentials.create() call
4 properties
X-Auth-Token
string
Enable via [configuration](https://github.com/teamhanko/hanko/blob/main/backend/docs/Config.mdhanko-backend-config) option session.enableauthtokenheader for pu…
X-Session-Lifetime
number
Contains the seconds until the session expires.
CredentialRequestOptions
object
Options for assertion generation with the WebAuthn API
1 property
Error
object
2 properties2 required
WebauthnLoginResponse
object
Response after a successful login with webauthn
2 properties
WebauthnCredential
object
11 properties
UUID4
string
WebauthnCredentials
array
A list of WebAuthn credentials
Specification
The full machine-readable OpenAPI contract behind this narrative.
