Get passkey

Get all passkey data for a passkey including the public key. Call this endpoint if you want to extract the public-key component of a passkey for use in another platform or library.

HTTP Request

GET https://api.passlock.dev/v2/{tenancyId}/passkeys/{passkeyId} HTTP/1.1
Authorization: Bearer {apiKey}
Accept: application/json

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json

{
  "_tag": "Passkey",
  "id": "sewqeeqx69cr7axut7kat",
  "userId": "puubifsmidah0f8c0y9bm",
  "enabled": true,
  "credential": {
    "id": "bW9wN3IzenE0enJ5OXVnZXoxOWF4",
    "userId": "MTVkMTFmdHM1Yzg0bDN0anpieG9w",
    "username": "jdoe@example.com",
    "aaguid": "0000-0000-0000-0000",
    "backedUp": true,
    "counter": 0,
    "deviceType": "multiDevice",
    "transports": ["internal"],
    "publicKey": "dGhpcy1pcy1hLWNib3ItcHVibGljLWtleQ",
    "rpId": "example.com"
  },
  "platform": {
    "icon": "https://api.passlock.dev/v2/aaguid/0000-0000-0000/icon.svg",
    "name": "Apple Passwords"
  },
  "createdAt": 1770123293,
  "updatedAt": 1770123293,
  "lastUsed": 1770123293
}

HTTP response properties

Property	Type	Description
id	string	passkeyId. Not to be confused with the credential.id
userId	string | undefined	Optional custom user ID. Not to be confused with the credential.userId
enabled	boolean	Passkey enabled
credential	object	WebAuthn data directly related to the browser’s credential
platform	object | undefined	Optional details about the authenticator platform
createdAt	number	Passkey creation date
updatedAt	number	Passkey update/changed date
lastUsed	number | undefined	Present if the passkey has been used for authentication

Optional fields

Some response properties are optional. For example, userId may be unset, platform details may be unavailable, and lastUsed will be missing until the passkey is used.

Server helper shape

The raw HTTP response encodes credential.publicKey as a Base64Url string so it can be represented in JSON. If you call getPasskey() from @passlock/server or @passlock/server/unsafe, that field is already decoded to a Uint8Array in the returned Passkey object.

Public-key format

The format and encoding used for the public key is complex. Specifically it’s a nested CBOR structure, using COSE encoding.

The entire structure is then Base64Url encoded to make it JSON compatible.

Fortunately the format is standardized, so you should be able to Base64Url decode the key and use it with other WebAuthn libraries.

credential

Property	Type	Description
id	string	Device native credential ID
userId	string	Device native credential user ID
aaguid	string	Global ID representing the platform used
backedUp	boolean	Backup/sync status
counter	number	Credential counter. Unreliable
deviceType	string	singleDevice or multiDevice
transports	array	Credential transport mechanisms
publicKey	string (Base64Url)	Base64Url encoded public key in the raw HTTP response
rpId	string	Relying Party ID associated with the credential

platform

Property	Type	Description
icon	string | undefined	Optional URL to an icon representing the authenticator platform
name	string | undefined	Optional platform name, e.g. Apple Passwords