Passkey login
Org-member passkey endpoints under /api/passkey. WebAuthn via the FIDO2 service; on register/login a web origin gets an HttpOnly cookie (SDK callers keep the body token).
One credential per account (stable user handle)
Section titled “One credential per account (stable user handle)”Every enrollment endpoint sets the WebAuthn user.id (userHandle) to a deterministic value derived from the normalized email (DeviceHelper.StableUserHandle), not a random or account-row id. Platform authenticators (Windows Hello, Touch ID) de-duplicate resident credentials by (rpId, userHandle), so re-registering the same email — including after a database reset — replaces the existing passkey instead of piling up a new one. This keeps the authenticator’s credential set at one per account, which is what keeps the sign-in dialog fast (it has a single credential to enumerate, not dozens).
The userHandle is not used for identity: login verification always resolves the account from the returned credentialId against the database, never from the handle.
Register (new account)
Section titled “Register (new account)”| Method · Route | Purpose | Source |
|---|---|---|
POST /register/options | Attestation options (Username, optional ApplicationKey, SecurityMode) | PasskeyEndpoints.cs:91 |
POST /register | Complete registration → auto-login (cookie issued) | :110 |
Add device (rotation)
Section titled “Add device (rotation)”| Method · Route | Purpose | Source |
|---|---|---|
POST /add/options | Enrollment options (authenticated). Passes ExcludeCredentials to prevent the cloud-sync duplicate-accumulation issue | :143 |
POST /add | Add a passkey to the current user (optional orgSlug) | :178 |
| Method · Route | Purpose | Source |
|---|---|---|
POST /login/options | Assertion options (optional email + ApplicationKey) | :215 |
POST /login | Complete assertion → cookie / token | :226 |
Helpers
Section titled “Helpers”GET /exists?email= (does the user exist / has passkey / login provider) and GET /browser-match?fingerprint= (authenticated) round out the set.