Skip to main content
POST
Predict the passkey login outcome

Authorizations

Authorization
string
header
required

Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.

Body

application/json

Send the user's passkeys either as plain IDs (credentialIDs) or with what the identity provider stored at registration (credentials), or both; at least one credential is required. Every field beyond the credential ID is optional and only fills what Observe does not know itself.

observeContext
string
required

Opaque Observe context from the login browser, for example its cbo_observe_context cookie value. Pass it unchanged; do not construct or decode it. Without it, skip this call and continue with your existing login behavior. Maximum 1024 characters.

credentialIDs
string[]

Base64url or base64 credential IDs of the account's passkeys. At most 50 entries, each up to 1400 characters.

credentials
object[]

The user's passkeys with the registration data the identity provider stored. Use instead of or together with credentialIDs; for the same credential ID these details are used. At most 50 entries.

Response

Login recommendation, reason, passkey retry policy and device-information source.

verdict
enum<string>
required

Recommended route: local starts the passkey login normally; phone prepares the user for a phone and QR code; try-once allows one attempt with the fallback visible; fallback starts another sign-in method. For reason: session-not-ready, retain your existing login behavior.

Available options:
local,
phone,
try-once,
fallback
reason
string
required

Why this route is recommended. Route by verdict; use reason for wording and reporting. More reasons may be added.

retryPolicy
object
required
environment
object
required