getTokenByPasskey method

Future<Credentials> getTokenByPasskey({
  1. required String authSession,
  2. required dynamic authResponse,
  3. String? connection,
  4. String? audience,
  5. Set<String> scopes = const {'openid', 'profile', 'email', 'offline_access'},
  6. String? organizationId,
  7. Map<PasskeyVerificationMethod, String> verification = const {},
})

Exchanges a passkey credential response for Auth0 tokens.

This is the final step of both the passkey login and signup flows. Call this after the browser's WebAuthn API (navigator.credentials.create()/.get()) returns the credential (from either passkeySignupChallenge or passkeyLoginChallenge).

Parameters:

  • authSession is the auth session received from the challenge response.
  • authResponse is the credential returned by navigator.credentials.create()/.get()
  • connection is the name of the database connection configured with passkeys.
  • audience relates to the API Identifier you want to reference in your access tokens. See API settings to learn more.
  • scopes defaults to openid profile email offline_access. You can override these scopes, but openid is always requested regardless of this setting.
  • organizationId is the optional Auth0 organization to authenticate with.
  • verification holds the one-time codes that verify ownership of the identifiers in WebPasskeyChallenge.verificationRequired, keyed by PasskeyVerificationMethod. Omit it when no verification is required.

Identifier verification

Pass a non-empty code in verification for every identifier listed in WebPasskeyChallenge.verificationRequired, or, on a retry, in WebException.passkeyVerificationRequired. Unlike iOS and Android, the web SDK does not check this before sending the request: an empty code is rejected by auth0-spa-js, but a missing one is only caught by the server, after the passkey has been created.

Retrying after a wrong code

If a code is wrong but the session is still alive, a WebException with WebException.isPasskeyVerificationRetryable set to true is thrown. Ask the user again for the codes in WebException.passkeyVerificationRequired only, and call this method again with the same authResponse and WebException.passkeyAuthSession as authSession. The user is not prompted for the passkey again.

Usage example

final challenge = await auth0Web.passkeyLoginChallenge(
  connection: 'Username-Password-Authentication',
);

final credential = await navigator.credentials.get(
  CredentialRequestOptions(
    publicKey: challenge.authParamsPublicKey
        as PublicKeyCredentialRequestOptions,
  ),
);

final credentials = await auth0Web.getTokenByPasskey(
  authSession: challenge.authSession,
  authResponse: credential,
  connection: 'Username-Password-Authentication',
);

Implementation

Future<Credentials> getTokenByPasskey({
  required final String authSession,
  required final dynamic authResponse,
  final String? connection,
  final String? audience,
  final Set<String> scopes = const {
    'openid',
    'profile',
    'email',
    'offline_access'
  },
  final String? organizationId,
  final Map<PasskeyVerificationMethod, String> verification = const {},
}) =>
    Auth0FlutterWebPlatform.instance.getTokenByPasskey(
      WebGetTokenByPasskeyOptions(
        authSession: authSession,
        authResponse: authResponse,
        connection: connection,
        audience: audience,
        scopes: scopes,
        organization: organizationId,
        verification: verification,
      ),
    );