supabase.auth.passkey — io.github.supabase-community/auth 0.8.0

Passkey (WebAuthn) REST API against Supabase Auth.

This is the low-level, two-step API plus passkey management, acting on behalf of the signed-in user identified by access-token — the JWT from an active session. The browser-side WebAuthn ceremony (prompting the user and marshalling credentials) lives in supabase.auth.webauthn; use it unless you run the ceremony yourself.

Two-step registration (requires an active session):

(require '[supabase.auth.passkey :as passkey])

;; 1. challenge + credential creation options for the browser
(passkey/start-registration client token)

;; 2. verify the credential the ceremony produced
(passkey/verify-registration client token challenge-id credential)

Two-step authentication (no session yet, so no access token — the client's API key authenticates the request, mirroring auth-js):

(passkey/start-authentication client)
(passkey/verify-authentication client challenge-id credential)

Management:

(passkey/list client token)
(passkey/update client token passkey-id "my laptop")
(passkey/delete client token passkey-id)

Each function returns {:status :body :headers} on success or an anomaly map on failure. On ClojureScript every function returns a js/Promise of that value instead (fetch is async-only). See https://supabase.com/docs/guides/auth/passkeys

delete clj/s

(delete client access-token passkey-id)

Deletes the passkey passkey-id for the user identified by access-token. Permanent; the credential can no longer sign in.

Example

(delete client "<access-token>" "<passkey-id>")

list clj/s

(list client access-token)

Lists the passkeys registered for the user identified by access-token.

On success the body is a vector of passkeys (:id, :friendly_name, :created_at, :last_used_at) — see supabase.auth.specs/Passkey.

Example

(list client "<access-token>")

start-authentication clj/s

(start-authentication client)

(start-authentication client params)

Starts the passkey authentication (sign-in) ceremony. The body carries :challenge_id, :options (W3C PublicKeyCredentialRequestOptionsJSON, base64url-encoded) and :expires_at.

No access-token: this runs before a session exists, so the request is authenticated with the client's API key only, mirroring auth-js.

params (optional):

• :captcha-token — CAPTCHA verification token

Pass :options to navigator.credentials.get (see supabase.auth.webauthn/deserialize-credential-request-options), then complete the flow with verify-authentication.

Example

(start-authentication client)

start-registration clj/s

(start-registration client access-token)

Starts the passkey registration ceremony for the user identified by access-token. The body carries :challenge_id, :options (W3C PublicKeyCredentialCreationOptionsJSON, base64url-encoded) and :expires_at (the key names are the server's wire form).

Pass :options to navigator.credentials.create (see supabase.auth.webauthn/deserialize-credential-creation-options), then complete the flow with verify-registration.

Example

(start-registration client "<access-token>")

update clj/s

(update client access-token passkey-id friendly-name)

Renames the passkey passkey-id to friendly-name for the user identified by access-token.

Example

(update client "<access-token>" "<passkey-id>" "my laptop")

verify-authentication clj/s

(verify-authentication client challenge-id credential)

Verifies the authentication credential produced by the WebAuthn ceremony against the challenge challenge-id issued by start-authentication. credential is the serialized assertion response (from supabase.auth.webauthn/serialize-credential-request-response, or the browser's own credential.toJSON() output); it is forwarded as-is.

On success the body carries a fresh session (access/refresh tokens and the embedded :user), like every other sign-in function; adopt it as the active session.

No access-token: this call creates the session, so the request is authenticated with the client's API key only, mirroring auth-js.

Example

(verify-authentication client "<challenge-id>" credential)

verify-registration clj/s

(verify-registration client access-token challenge-id credential)

Verifies the registration credential produced by the WebAuthn ceremony against the challenge challenge-id issued by start-registration. credential is the serialized registration response (from supabase.auth.webauthn/serialize-credential-creation-response, or the browser's own credential.toJSON() output); it is forwarded as-is.

On success the body carries the registered passkey metadata (:id, :friendly_name, :created_at).

Example

(verify-registration client "<access-token>" "<challenge-id>" credential)