Sign in with a passkey in the embedded approval

POST/v1/embed/sign-in

Verifies the assertion against the session's challenge. It must come from the approval in a frame whose top-level origin is the embed's platform (crossOrigin true, topOrigin that origin). The session then signs for the passkey's user.

Headers

Content-Typeapplication/jsonRequired
keelson-embedstring
Idempotency-KeystringRequired: 1 to 255 characters. A retry with the same key returns the first answer.

Request body

application/json

idstringRequired
rawIdstringRequired
typestringRequired: One of public-key
responseobjectRequired
authenticatorAttachmentstring
clientExtensionResultsobject

Responses

200Who the frame signs for
401No live embed session, or the passkey did not verify

200 response

passkeysarray of objectRequired
credentialIdstringRequired

curl -X POST https://api.keelson.finance/v1/embed/sign-in \
  -H 'content-type: application/json' \
  -H 'keelson-embed: <keelson-embed>' \
  -H "idempotency-key: $(uuidgen)" \
  --data '{"id":"string","rawId":"string","type":"public-key","response":{},"authenticatorAttachment":"string","clientExtensionResults":{}}'

const res = await fetch("https://api.keelson.finance/v1/embed/sign-in", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    "keelson-embed": "<keelson-embed>",
    "idempotency-key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    "id": "string",
    "rawId": "string",
    "type": "public-key",
    "response": {},
    "authenticatorAttachment": "string",
    "clientExtensionResults": {}
  }),
});
const data = await res.json();

Response · shape from the schema

{
  "passkeys": [
    {
      "credentialId": "string",
      "payment": true
    }
  ],
  "credentialId": "string"
}