Xeonr Developer Docs
API SpecificationPRIVATEAuthentication

Begin Passkey Login

POST
/xeonr.auth.private.v1.AuthService/PasskeyLoginBegin

Starts a WebAuthn passkey login: returns PublicKeyCredentialRequestOptions for a discoverable (usernameless) assertion plus a session id. The org is taken from the X-Xeonr-Auth-Org-Id header and the RP ID is derived from its domain.

Authentication: None required

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.AuthService/PasskeyLoginBegin" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "optionsJson": "string",
  "sessionId": "string"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Handle Signup POST

Completes the signup process for new users by setting their username. Requires a valid signup token from HandleLogin. **Authentication:** None required (signup token required)

Complete Passkey Login POST

Verifies a WebAuthn assertion, resolves the org-account user (asserting it belongs to the request org), and mints the portal token. A passkey satisfies MFA, so no step-up is required. **Authentication:** None required (session id required)