Prepare passkey updates

Prepare a user-scoped passkey update. The prepare endpoint updates the stored Passlock vault username for the user’s passkeys and returns a short-lived token for browser-side WebAuthn signalling.

1
POST https://api.passlock.dev/v2/{tenancyId}/passkeys/update HTTP/1.1
2
Authorization: Bearer {apiKey}
3
Accept: application/json
4
Content-Type: application/json
5

6
{
7
  "userId": "tenant-user-id",
8
  "username": "jdoe@example.com",
9
  "displayName": "Jane Doe"
10
}

1
HTTP/1.1 202 Accepted
2
Content-Type: application/json
3

4
{
5
  "_tag": "PreparedPasskeyUpdate",
6
  "updatePasskeysToken": "opaque-random-token",
7
  "expiresAt": 1770123593000,
8
  "warnings": []
9
}

Send only updatePasskeysToken to your frontend, then call @passlock/browser’s updatePasskeys helper. The browser helper exchanges the token with:

1
POST https://api.passlock.dev/v2/{tenancyId}/passkeys/update/exchange HTTP/1.1
2
Accept: application/json
3
Content-Type: application/json
4

5
{
6
  "updatePasskeysToken": "opaque-random-token"
7
}

1
HTTP/1.1 200 OK
2
Content-Type: application/json
3

4
{
5
  "_tag": "PasskeyUpdateInstructions",
6
  "instructions": [
7
    {
8
      "rpId": "example.com",
9
      "userId": "MTVkMTFmdHM1Yzg0bDN0anpieG9w",
10
      "username": "jdoe@example.com",
11
      "displayName": "Jane Doe"
12
    }
13
  ],
14
  "warnings": []
15
}

Warnings are non-fatal. For example, updating a user with no passkeys succeeds with a token and a NO_PASSKEYS_FOUND warning.

Server helper

Prefer @passlock/server where possible:

1
import { Passlock } from "@passlock/server";
2

3
const passlock = new Passlock({ tenancyId, apiKey });
4

5
const result = await passlock.updatePasskeys({
6
  userId: user.id,
7
  username: "jdoe@example.com",
8
  displayName: "Jane Doe",
9
});