@auth0/auth0-spa-js/dist/typings/passkey/PasskeyApiClient.d.ts

Auth0 SDK for Single Page Applications using Authorization Code Grant Flow with PKCE

import type { Auth0Client } from '../Auth0Client';
import type { TokenEndpointResponse } from '../global';
import type { PasskeySignupOptions, PasskeyLoginOptions, PasskeySignupChallengeOptions, PasskeyLoginChallengeOptions, PasskeySignupChallenge, PasskeyLoginChallenge, PasskeyGetTokenOptions } from './types';
import type { PasskeyClient } from '@auth0/auth0-auth-js';
/**
 * Client for Auth0 Passkey operations.
 *
 * Provides 2 public methods:
 * - `signup` — Register a new user with a passkey (full flow: challenge → WebAuthn → token exchange)
 * - `login` — Sign in with a passkey (full flow: challenge → WebAuthn → token exchange)
 *
 * @example
 * ```typescript
 * // Signup — single call handles everything
 * const tokens = await auth0.passkey.signup({ email: 'user@example.com' });
 *
 * // Login — single call handles everything
 * const tokens = await auth0.passkey.login();
 * ```
 *
 * @category Clients
 */
export declare class PasskeyApiClient {
    #private;
    /**
     * @internal
     * Do not instantiate directly. Use Auth0Client.passkey instead.
     */
    constructor(passkeyClient: PasskeyClient, auth0Client: Auth0Client);
    /**
     * Register a new user with a passkey.
     *
     * Handles the full flow: requests a signup challenge, triggers the browser
     * WebAuthn credential creation ceremony, serializes the result, and exchanges
     * it for tokens.
     *
     * If the server requires identifier verification, it stops before creating the
     * passkey and throws `PasskeyVerificationRequiredError`. Collect the OTP codes
     * and call `continueSignup()` to finish.
     *
     * @param options - Passkey signup options (user identifier, optional scope/audience)
     * @returns A promise that resolves to the token endpoint response containing access/ID tokens
     * @throws {PasskeyError} If WebAuthn is not supported in the browser
     * @throws {PasskeyRegisterError} If the challenge request fails
     * @throws {PasskeyVerificationRequiredError} If OTP codes are needed before the passkey is created
     * @throws {GenericError} If the token exchange fails
     * @throws {PasskeyError} If the user cancels the WebAuthn prompt
     */
    signup(options: PasskeySignupOptions): Promise<TokenEndpointResponse>;
    /**
     * Sign in with an existing passkey.
     *
     * Handles the full flow: requests a login challenge, triggers the browser
     * WebAuthn assertion ceremony, serializes the result, and exchanges it
     * for tokens.
     *
     * @param options - Optional passkey login options (optional scope/audience/realm/organization)
     * @returns A promise that resolves to the token endpoint response containing access/ID tokens
     * @throws {PasskeyError} If WebAuthn is not supported in the browser
     * @throws {PasskeyChallengeError} If the challenge request fails
     * @throws {GenericError} If the token exchange fails
     * @throws {PasskeyError} If the user cancels the WebAuthn prompt
     */
    login(options?: PasskeyLoginOptions): Promise<TokenEndpointResponse>;
    /**
     * Request a passkey signup challenge.
     *
     * Step 1 of the granular signup flow. Returns the auth session and a
     * decoded `PublicKeyCredentialCreationOptions`. Run the WebAuthn credential
     * creation ceremony with `publicKey`, then hand the resulting credential and `authSession` to
     * `getTokenWithPasskey()`.
     *
     * @param options - Signup challenge options (user identifier, optional realm/organization/metadata)
     * @returns A promise resolving to `{ authSession, publicKey }`
     * @throws {PasskeyError} If WebAuthn is not supported in the browser
     * @throws {PasskeyRegisterError} If the challenge request fails
     */
    getSignupChallenge(options: PasskeySignupChallengeOptions): Promise<PasskeySignupChallenge>;
    /**
     * Request a passkey login challenge.
     *
     * Step 1 of the granular login flow. Returns the auth session and a
     * decoded `PublicKeyCredentialRequestOptions`. Run the WebAuthn assertion
     * ceremony with `publicKey`, then hand the resulting credential and `authSession` to
     * `getTokenWithPasskey()`.
     *
     * @param options - Optional login challenge options (realm/organization)
     * @returns A promise resolving to `{ authSession, publicKey }`
     * @throws {PasskeyError} If WebAuthn is not supported in the browser
     * @throws {PasskeyChallengeError} If the challenge request fails
     */
    getLoginChallenge(options?: PasskeyLoginChallengeOptions): Promise<PasskeyLoginChallenge>;
    /**
     * Exchange a signed passkey credential for tokens.
     *
     * Step 2 of the granular flow. Serializes the raw `PublicKeyCredential`
     * produced by the WebAuthn ceremony — either a creation (signup) or an
     * assertion (login) credential — and exchanges it for tokens. The credential
     * type (attestation vs assertion) is detected automatically.
     *
     * @param options - The auth session, raw credential, and optional realm/organization/scope/audience
     * @returns A promise resolving to the token endpoint response
     * @throws {PasskeyError} If WebAuthn is not supported in the browser
     * @throws {PasskeyError} If the credential is not a valid attestation or assertion response
     * @throws {PasskeyError} If a code in `verification` is empty. Nothing is sent, so the same session can be retried
     * @throws {PasskeyGetTokenError} If an OTP code is wrong and the session is still active (`isRetryable: true`)
     * @throws {GenericError} If the token exchange fails
     */
    getTokenWithPasskey(options: PasskeyGetTokenOptions): Promise<TokenEndpointResponse>;
    /**
     * Continue a signup that was interrupted by identifier verification.
     *
     * Call this after catching `PasskeyVerificationRequiredError` from `signup()`,
     * collecting OTP codes from the user, and passing them here. The SDK
     * internally retains the auth session — you do not need to pass it.
     *
     * If the codes are wrong but the session is still alive, this throws a
     * `PasskeyGetTokenError` with `isRetryable: true`. Collect new codes for
     * `error.verificationRequired` and call `continueSignup()` again; the same
     * passkey is reused, so the user is not prompted again.
     *
     * @param verification - Map of identifier → OTP code (e.g. `{ phone: "123456" }`)
     * @returns A promise resolving to the token endpoint response
     * @throws {PasskeyError} If there is no pending signup (signup() was not called first)
     * @throws {PasskeyError} If a code is missing for a required identifier. The pending signup is kept
     * @throws {PasskeyGetTokenError} If an OTP code is wrong and the session is still active (`isRetryable: true`)
     * @throws {GenericError} If the token exchange fails
     */
    continueSignup(verification: {
        email?: string;
        phone?: string;
    }): Promise<TokenEndpointResponse>;
}