passkey

The passkey domain has 21 actions. On the meta surface they are all reached through arcane_passkey; on the individual surface each one is its own tool; on the dynamic surface run them with arcane_execute_action and the canonical ID.

Summary

Action	Title	Kind
`passkey.capabilities`	Get passkey capabilities	read
`passkey.delete`	Delete my passkey	destructive
`passkey.list`	List my passkeys	read
`passkey.login_availability`	Get passkey login availability	read
`passkey.login_begin`	Begin passkey login	write
`passkey.login_finish`	Finish passkey login	write
`passkey.mfa_begin`	Begin passkey MFA	write
`passkey.mfa_disable`	Disable passkey MFA	destructive
`passkey.mfa_enable`	Enable passkey MFA	write
`passkey.mfa_finish`	Finish passkey MFA	write
`passkey.mfa_status`	Get passkey MFA status	read
`passkey.mobile_login_exchange`	Exchange mobile passkey login	write
`passkey.mobile_login_finish`	Finish mobile passkey login	write
`passkey.recovery_code_use`	Use an MFA recovery code	write
`passkey.recovery_codes_regenerate`	Regenerate MFA recovery codes	destructive
`passkey.registration_begin`	Begin passkey registration	write
`passkey.registration_finish`	Finish passkey registration	write
`passkey.rename`	Rename my passkey	write
`passkey.step_up_begin`	Begin passkey step-up	write
`passkey.step_up_finish`	Finish passkey step-up	write
`passkey.step_up_password`	Reauthenticate with password	write

Actions

`passkey.capabilities`

Get passkey capabilities

Kind: read
Required parameters: none
Meta tool: arcane_passkey with "action": "capabilities"
Individual tool: arcane_passkey_capabilities
Arcane route: GET /api/auth/me/passkeys/capabilities
Operation ID: get-passkey-capabilities
Usage: What the caller’s own account can do with passkeys: passkeyCount, passkeyMfaEnabled, hasLocalPassword, hasOidcFallback, canEnrollWithActiveSession (true only with no passkey yet, so no step-up is needed), canDeleteLastPasskey and requiresStepUp (true once a passkey exists). Needs a logged-in session (ARCANE_USERNAME/ARCANE_PASSWORD), not an API key.
Related actions: passkey.list, passkey.mfa_status, passkey.registration_begin, passkey.step_up_password

`passkey.delete`

Delete my passkey

Kind: destructive — requires confirm: true
Required parameters: id
Meta tool: arcane_passkey with "action": "delete"
Individual tool: arcane_passkey_delete
Arcane route: DELETE /api/auth/me/passkeys/{id}
Operation ID: delete-my-passkey
Usage: Permanently removes one of the caller’s passkeys (id from passkey.list). Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session. The last passkey cannot be deleted while passkey MFA is on (run passkey.mfa_disable first) or when the account has no password or OIDC login left. passkey.capabilities reports canDeleteLastPasskey.
Related actions: passkey.list, passkey.step_up_password, passkey.capabilities, passkey.mfa_disable

`passkey.list`

List my passkeys

Kind: read
Required parameters: none
Meta tool: arcane_passkey with "action": "list"
Individual tool: arcane_passkey_list
Arcane route: GET /api/auth/me/passkeys
Operation ID: list-my-passkeys
Usage: Lists the caller’s own passkeys for this instance, oldest first: id (the id for passkey.rename and passkey.delete), name, rpId, transports, backup flags, cloneWarning, createdAt and lastUsedAt. Needs a logged-in session, not an API key. Other users’ passkeys are not visible.
Related actions: passkey.rename, passkey.delete, passkey.registration_begin, passkey.capabilities

`passkey.login_availability`

Get passkey login availability

Kind: read
Required parameters: none
Meta tool: arcane_passkey with "action": "login_availability"
Individual tool: arcane_passkey_login_availability
Arcane route: GET /api/auth/passkey/login/availability
Operation ID: get-passkey-login-availability
Since: Arcane v2.10.2
Usage: Public check (no credentials) whether any passkey is registered on this Arcane instance’s WebAuthn domain, i.e. whether a passkey login can work at all. It does not say which user. It is also false (not an error) when Arcane’s APP_URL is invalid, in which case every other passkey action fails with 500 ‘passkey service is unavailable’.
Related actions: passkey.login_begin

`passkey.login_begin`

Begin passkey login

Begin a discoverable WebAuthn passkey login ceremony

Kind: write
Required parameters: none
Meta tool: arcane_passkey with "action": "login_begin"
Individual tool: arcane_passkey_login_begin
Arcane route: POST /api/auth/passkey/login/begin
Operation ID: begin-passkey-login
Usage: Starts a username-less (discoverable) passkey login. Needs no credentials. Returns ceremonyId and WebAuthn assertion options (valid 5 minutes, single use) for an authenticator to answer. Send the result to passkey.login_finish, or to passkey.mobile_login_finish for the mobile-app flow. For password login use auth.login. Like the other public passkey login and MFA routes it is rate-limited to 5 calls per minute per client IP (429 ‘rate limit exceeded’).
Related actions: passkey.login_finish, passkey.mobile_login_finish, passkey.login_availability, auth.login

`passkey.login_finish`

Finish passkey login

Validate a discoverable WebAuthn assertion and create a session

Kind: write
Required parameters: credential
Meta tool: arcane_passkey with "action": "login_finish"
Individual tool: arcane_passkey_login_finish
Arcane route: POST /api/auth/passkey/login/finish
Operation ID: finish-passkey-login
Usage: Completes a passkey login: ceremonyId from passkey.login_begin and credential, the authenticator’s WebAuthn assertion as a JSON object. Returns status authenticated with token, refreshToken and the matched user. The tokens are only returned, this server keeps its own credentials.
Related actions: passkey.login_begin, auth.refresh

`passkey.mfa_begin`

Begin passkey MFA

Begin a WebAuthn assertion for a pending MFA transaction

Kind: write
Required parameters: transactionId
Meta tool: arcane_passkey with "action": "mfa_begin"
Individual tool: arcane_passkey_mfa_begin
Arcane route: POST /api/auth/mfa/passkey/begin
Operation ID: begin-passkey-mfa
Usage: Second step of a login that answered status mfa_required (auth.login): auth.login already returns mfa.options, so call this only for a fresh challenge: pass mfa.transactionId to get new WebAuthn assertion options, which invalidates the earlier options of that transaction. Answer them with the user’s passkey and call passkey.mfa_finish, or use passkey.recovery_code_use instead. Needs no credentials. The transaction expires 5 minutes after the login.
Related actions: auth.login, passkey.mfa_finish, passkey.recovery_code_use

`passkey.mfa_disable`

Disable passkey MFA

Kind: destructive — requires confirm: true
Required parameters: none
Meta tool: arcane_passkey with "action": "mfa_disable"
Individual tool: arcane_passkey_mfa_disable
Arcane route: POST /api/auth/me/mfa/disable
Operation ID: disable-passkey-mfa
Usage: Turns off passkey MFA for the caller, deletes all their recovery codes and revokes every other session of the account (this one stays). Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session. Fails when MFA is not on.
Related actions: passkey.step_up_password, passkey.mfa_status, passkey.mfa_enable

`passkey.mfa_enable`

Enable passkey MFA

Kind: write
Required parameters: none
Meta tool: arcane_passkey with "action": "mfa_enable"
Individual tool: arcane_passkey_mfa_enable
Arcane route: POST /api/auth/me/mfa/enable
Operation ID: enable-passkey-mfa
Usage: Turns on passkey MFA for the caller: afterwards a password (or OIDC) login returns status mfa_required and must be completed with a passkey or recovery code. Needs at least one registered passkey, a logged-in session and stepUpToken from passkey.step_up_password or passkey.step_up_finish. Returns 10 recovery codes shown only this once, so store them. Do not enable it on the account this server logs in with (ARCANE_USERNAME): its next fresh login would stop at mfa_required and fail.
Related actions: passkey.step_up_password, passkey.registration_begin, passkey.mfa_status, passkey.recovery_codes_regenerate

`passkey.mfa_finish`

Finish passkey MFA

Validate a WebAuthn MFA assertion and create the authenticated session

Kind: write
Required parameters: credential, transactionId
Meta tool: arcane_passkey with "action": "mfa_finish"
Individual tool: arcane_passkey_mfa_finish
Arcane route: POST /api/auth/mfa/passkey/finish
Operation ID: finish-passkey-mfa
Usage: Completes an mfa_required login: transactionId from auth.login (mfa.transactionId) and credential, the passkey’s WebAuthn assertion to the latest options (mfa.options from auth.login, or from passkey.mfa_begin if it was called). Returns status authenticated with token, refreshToken and user. The tokens are only returned, this server keeps its own credentials.
Related actions: passkey.mfa_begin, passkey.recovery_code_use, auth.login, auth.refresh

`passkey.mfa_status`

Get passkey MFA status

Kind: read
Required parameters: none
Meta tool: arcane_passkey with "action": "mfa_status"
Individual tool: arcane_passkey_mfa_status
Arcane route: GET /api/auth/me/mfa
Operation ID: get-passkey-mfa-status
Usage: Whether passkey MFA is on for the caller’s own account, with passkeyCount and recoveryCodesRemaining (unused recovery codes). Needs a logged-in session, not an API key.
Related actions: passkey.mfa_enable, passkey.mfa_disable, passkey.recovery_codes_regenerate, passkey.capabilities

`passkey.mobile_login_exchange`

Exchange mobile passkey login

Consume a verifier-bound mobile passkey transaction and create a session

Kind: write
Required parameters: codeVerifier, transactionId
Meta tool: arcane_passkey with "action": "mobile_login_exchange"
Individual tool: arcane_passkey_mobile_login_exchange
Arcane route: POST /api/auth/passkey/mobile/exchange
Operation ID: exchange-mobile-passkey-login
Usage: App half of the mobile passkey login: transactionId from passkey.mobile_login_finish and codeVerifier, the PKCE verifier (exactly 32 random bytes, unpadded base64url, 43 characters) whose SHA-256 was sent as codeChallenge. Single use. Returns status authenticated with token, refreshToken and user (no cookie).
Related actions: passkey.mobile_login_finish, auth.refresh

`passkey.mobile_login_finish`

Finish mobile passkey login

Validate a browser assertion and create a one-time mobile exchange

Kind: write
Required parameters: ceremonyId, codeChallenge, credential
Meta tool: arcane_passkey with "action": "mobile_login_finish"
Individual tool: arcane_passkey_mobile_login_finish
Arcane route: POST /api/auth/passkey/mobile/finish
Operation ID: finish-mobile-passkey-login
Usage: Browser half of the mobile-app passkey login: ceremonyId from passkey.login_begin, credential (the WebAuthn assertion) and codeChallenge, the 43-character base64url SHA-256 of the app’s PKCE code verifier. Issues no tokens. Returns a one-time transactionId (valid 5 minutes) that the app redeems with passkey.mobile_login_exchange.
Related actions: passkey.login_begin, passkey.mobile_login_exchange

`passkey.recovery_code_use`

Use an MFA recovery code

Consume one recovery code for a pending MFA transaction

Kind: write
Required parameters: code, transactionId
Meta tool: arcane_passkey with "action": "recovery_code_use"
Individual tool: arcane_passkey_recovery_code_use
Arcane route: POST /api/auth/mfa/recovery
Operation ID: use-passkey-recovery-code
Usage: Completes an mfa_required login without the passkey: transactionId from auth.login (mfa.transactionId) and one unused recovery code (dashes and case are ignored). Each code works once. Returns status authenticated with token, refreshToken and user. Rate-limited to 5 attempts per minute per client IP (429).
Related actions: auth.login, passkey.mfa_begin, passkey.recovery_codes_regenerate, passkey.mfa_status

`passkey.recovery_codes_regenerate`

Regenerate MFA recovery codes

Kind: destructive — requires confirm: true
Required parameters: none
Meta tool: arcane_passkey with "action": "recovery_codes_regenerate"
Individual tool: arcane_passkey_recovery_codes_regenerate
Arcane route: POST /api/auth/me/mfa/recovery-codes/regenerate
Operation ID: regenerate-passkey-recovery-codes
Usage: Replaces all of the caller’s MFA recovery codes with 10 new ones, returned only this once. The old codes stop working. Only while passkey MFA is on. Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session.
Related actions: passkey.mfa_status, passkey.step_up_password, passkey.recovery_code_use

`passkey.registration_begin`

Begin passkey registration

Kind: write
Required parameters: none
Meta tool: arcane_passkey with "action": "registration_begin"
Individual tool: arcane_passkey_registration_begin
Arcane route: POST /api/auth/me/passkeys/register/begin
Operation ID: begin-passkey-registration
Usage: Starts enrolling a new passkey for the caller (logged-in session only). The first passkey of an account needs no stepUpToken. Once one exists, pass stepUpToken from passkey.step_up_password or passkey.step_up_finish. Returns ceremonyId and WebAuthn creation options (valid 5 minutes) that a WebAuthn authenticator must answer. Send its credential to passkey.registration_finish.
Related actions: passkey.registration_finish, passkey.capabilities, passkey.step_up_password

`passkey.registration_finish`

Finish passkey registration

Kind: write
Required parameters: credential
Meta tool: arcane_passkey with "action": "registration_finish"
Individual tool: arcane_passkey_registration_finish
Arcane route: POST /api/auth/me/passkeys/register/finish
Operation ID: finish-passkey-registration
Usage: Completes enrolment: ceremonyId from passkey.registration_begin (single use, same session, within 5 minutes) and credential, the authenticator’s WebAuthn attestation response as a JSON object. Optional name (up to 128 characters) defaults to ‘<authenticator model> Passkey’ when the authenticator is known, else ‘New Passkey’. A credential that is already registered is refused with 409. Returns the stored passkey with its id.
Related actions: passkey.registration_begin, passkey.list, passkey.mfa_enable

`passkey.rename`

Rename my passkey

Kind: write
Required parameters: id, name
Meta tool: arcane_passkey with "action": "rename"
Individual tool: arcane_passkey_rename
Arcane route: PUT /api/auth/me/passkeys/{id}
Operation ID: rename-my-passkey
Usage: Renames one of the caller’s passkeys: id from passkey.list, name 1-128 characters. Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session. Returns the updated passkey summary.
Related actions: passkey.list, passkey.step_up_password, passkey.step_up_finish

`passkey.step_up_begin`

Begin passkey step-up

Kind: write
Required parameters: none
Meta tool: arcane_passkey with "action": "step_up_begin"
Individual tool: arcane_passkey_step_up_begin
Arcane route: POST /api/auth/me/passkeys/reauth/begin
Operation ID: begin-passkey-step-up
Usage: Starts re-authentication with one of the caller’s passkeys, the alternative to passkey.step_up_password. Needs a logged-in session and at least one registered passkey. Returns transactionId and WebAuthn assertion options (valid 5 minutes) for an authenticator to answer, then call passkey.step_up_finish.
Related actions: passkey.step_up_finish, passkey.step_up_password

`passkey.step_up_finish`

Finish passkey step-up

Kind: write
Required parameters: credential, transactionId
Meta tool: arcane_passkey with "action": "step_up_finish"
Individual tool: arcane_passkey_step_up_finish
Arcane route: POST /api/auth/me/passkeys/reauth/finish
Operation ID: finish-passkey-step-up
Usage: Completes passkey re-authentication: transactionId from passkey.step_up_begin (same session) and credential, the authenticator’s WebAuthn assertion as a JSON object. Returns the step-up token (token, expiresAt) to pass as stepUpToken to passkey management and MFA actions. It is reusable until it expires, which is 5 minutes after passkey.step_up_begin, not after this call.
Related actions: passkey.step_up_begin, passkey.rename, passkey.delete, passkey.mfa_enable

`passkey.step_up_password`

Reauthenticate with password

Kind: write
Required parameters: password
Meta tool: arcane_passkey with "action": "step_up_password"
Individual tool: arcane_passkey_step_up_password
Arcane route: POST /api/auth/me/passkeys/reauth/password
Operation ID: password-step-up
Usage: Re-authenticates with the caller’s own password and returns a step-up token (token, expiresAt about 5 minutes ahead), reusable until it expires but bound to this session (if this server has to log in again, the token stops working and the call fails with 401 ‘fresh step-up authentication is required’, so run this again). Pass it as stepUpToken to passkey.rename, passkey.delete, passkey.registration_begin, passkey.mfa_enable, passkey.mfa_disable and passkey.recovery_codes_regenerate. Fails for accounts without a local password (use passkey.step_up_begin instead). Needs a logged-in session, not an API key.
Related actions: passkey.step_up_begin, passkey.mfa_enable, passkey.delete, passkey.rename