> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate

> Authenticate using the Stytch Vanilla JS SDK

`webauthn.authenticate` [authenticate\_start](/docs/api-reference/consumer/api/passkeys-webauthn/authenticate/start.md) and [authenticate](/docs/api-reference/consumer/api/passkeys-webauthn/authenticate/authenticate.md) WebAuthn endpoints, the [Credential Manager API](https://developer.android.com/training/sign-in/passkeys) on Android and the [CredentialProvider API](https://developer.apple.com/documentation/authenticationservices/supporting-passkeys#3761743) on iOS.

Call `webauthn.authenticate` inside an event callback triggered by a user gesture to authenticate a user using an existing WebAuthn registration.

## Parameters

**domain** `string`

The domain for Passkeys or WebAuthn. Defaults to window\.location.hostname.

**is\_passkey** `boolean`

If true, the WebAuthn flow will be optimized for Passkeys by altering the public\_key\_credential\_creation\_options used.

**signal** `object`

An optional AbortSignal to allow aborting the Passkey or WebAuthn authentication process.

**conditional\_mediation** `boolean`

Whether to use conditional mediation (autofill) in the authentication flow.

**session\_duration\_minutes** `int`

Set the session lifetime to be this many minutes from now. This will start a new session if one doesn't already exist, returning both an opaque session\_token and session\_jwt for this session. Remember that the `session_jwt` will have a fixed lifetime of five minutes regardless of the underlying session duration, and will need to be refreshed over time. This value must be a minimum of 5 and a maximum of 527040 minutes (366 days). If a session\_token or session\_jwt is provided then a successful authentication will continue to extend the session this many minutes. If the session\_duration\_minutes parameter is not specified, a Stytch session will not be created.

## Response

**webauthn\_registration\_id** `string`

The unique ID for the Passkey or WebAuthn registration.

**user\_id** `string`

The unique ID of the affected User.

**user** `object`

The user object affected by call.  See the [User object](/docs/api-reference/consumer/api/users/user-object.md) for complete response field details.

**properties**

**created\_at** `string`

The timestamp of the User's creation. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**crypto\_wallets** `array[objects]`

An array contains a list of all crypto wallets for a given User in the Stytch API.

**properties**

**crypto\_wallet\_id** `string`

The unique ID for a crypto wallet

**crypto\_wallet\_address** `string`

The actual blockchain address of the User's crypto wallet.

**crypto\_wallet\_type** `string`

The blockchain that the User's crypto wallet operates on, e.g. Ethereum, Solana, etc.

**verified** `boolean`

If this method has been successfully authenticated by the User.

**emails** `array[objects]`

An array of email objects for the User.

**properties**

**email\_id** `string`

The unique ID of a specific email address.

**email** `string`

The email address.

**verified** `boolean`

If this method has been successfully authenticated by the User.

**name** `object`

The name of the User. Each field in the name object is optional.

**properties**

**first\_name** `string`

The first name of the user.

**middle\_name** `string`

The middle name(s) of the user.

**last\_name** `string`

The last name of the user.

**trusted\_metadata** `object`

The trusted\_metadata field contains an arbitrary JSON object of application-specific data. See the [Metadata](/docs/api-reference/consumer/api/resources/metadata.md) reference for complete field behavior details.

**untrusted\_metadata** `object`

The untrusted\_metadata field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and **cannot be used to store critical information.** See the [Metadata](/docs/api-reference/consumer/api/resources/metadata.md) reference for complete field behavior details.

**phone\_numbers** `array[objects]`

An array of phone number objects linked to the User.

**properties**

**phone\_id** `string`

The unique ID for the phone number.

**phone\_number** `string`

The phone number.

**verified** `boolean`

If this method has been successfully authenticated by the User.

**providers** `array[objects]`

An array of OAuth provider objects linked to the User.

**properties**

**oauth\_user\_registration\_id** `string`

The unique ID for an OAuth registration.

**provider\_subject** `string`

The unique identifier for the User within a given OAuth provider. Also commonly called the "sub" or "Subject field" in OAuth protocols.

**provider\_type** `string`

Denotes the OAuth identity provider that the user has authenticated with, e.g. Google, Facebook, GitHub etc.

**profile\_picture\_url** `string`

If available, the profile\_picture\_url is a url of the User's profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture.

**locale** `string`

If available, the locale is the User's locale set in the OAuth identity provider that the user has authenticated with.

**password** `object`

The password object is returned for users with a password.

**properties**

**password\_id** `string`

The unique ID of a specific password

**requires\_reset** `boolean`

Indicates whether this password requires a password reset

**status** `string`

The status of the User. The possible values are `pending` and `active`.

**totps** `array[objects]`

An array containing a list of all TOTP instances for a given User in the Stytch API.

**properties**

**totp\_id** `string`

The unique ID for a TOTP instance.

**verified** `boolean`

If this method has been successfully authenticated by the User.

**user\_id** `string`

The unique ID of the affected User.

**webauthn\_registrations** `array[objects]`

An array that contains a list of all Passkey or WebAuthn registrations for a given User in the Stytch API.

**properties**

**webauthn\_registration\_id** `string`

The unique ID for the Passkey or WebAuthn registration.

**domain** `string`

The domain on which Passkey or WebAuthn registration was started. This will be the domain of your app.

**user\_agent** `string`

The user agent of the User.

**authenticator\_type** `string`

The authenticator\_type string displays the requested authenticator type of the Passkey or WebAuthn device. The two valid types are "platform" and "cross-platform". If no value is present, the Passkey or WebAuthn device was created without an authenticator type preference.

**verified** `boolean`

If this method has been successfully authenticated by the User.

**name** `string`

The name of the Passkey or WebAuthn registration.

**biometric\_registrations** `array[objects]`

An array that contains a list of all biometric registrations for a given User in the Stytch API.

**properties**

**biometric\_registration\_id** `string`

The unique ID for a biometric registration.

**verified** `boolean`

If this method has been successfully authenticated by the User.

**roles** `array[strings]`

Roles assigned to this User. See the [RBAC guide](/docs/consumer-auth/authorization/assigning-roles-to-users.md) for more information about role assignment.

**session\_token** `string`

A secret token for a given Stytch Session.

**session\_jwt** `string`

The JSON Web Token (JWT) for a given Stytch Session.

**session** `object`

If you initiate a Session, by including session\_duration\_minutes in your authenticate call, you'll receive a full Session object in the response. See [Session object](/docs/api-reference/consumer/api/sessions/session-object.md) for complete response fields.

**properties**

**session\_id** `string`

A unique identifier for a specific Session.

**user\_id** `string`

The unique ID of the affected User.

**authentication\_factors** `array[objects]`

An array of different authentication factors that comprise a Session.

**started\_at** `string`

The timestamp when the Session was created. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**last\_accessed\_at** `string`

The timestamp when the Session was last accessed. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**expires\_at** `string`

The timestamp when the Session expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**attributes** `object`

Provided attributes help with fraud detection.

**properties**

**ip\_address** `string`

The IP address of the user.

**user\_agent** `string`

The user agent of the User.

**custom\_claims** `map`

The custom claims map for a Session. Claims can be added to a session during a Sessions authenticate call.

**roles** `array[string]`

A list of the roles associated with the session.

**user\_device** `object`

If [Protected Auth](/docs/fraud-risk/device-fingerprinting/protected-auth.md) is enabled and returned fingerprinting results, the user\_device response field will contain information about the user's device attributes.

**properties**

**ip\_address** `string`

The IP address of the user's device.

**ip\_address\_details** `object`

Information about the ip\_address.

**properties**

**is\_new** `boolean`

Whether this ip\_address has been seen before for this user.

**first\_seen\_at** `string`

When this ip\_address was first seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**last\_seen\_at** `string`

When this ip\_address was last seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**ip\_geo\_country** `string`

The country code where the IP address is located.

**ip\_geo\_country\_details** `object`

Information about the ip\_geo\_country.

**properties**

**is\_new** `boolean`

Whether this ip\_geo\_country has been seen before for this user.

**first\_seen\_at** `string`

When this ip\_geo\_country was first seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**last\_seen\_at** `string`

When this ip\_geo\_country was last seen for this user. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. 2021-12-29T12:33:09Z.

**ip\_geo\_city** `string`

The city where the IP address is located.

**ip\_geo\_region** `string`

The region where the IP address is located.

**request\_id** `string`

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we
may ask for this value to help identify a specific API call when helping you debug an issue.

**status\_code** `number`

The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values
equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

```js theme={null}
import { StytchClient } from '@stytch/vanilla-js';

const stytch = new StytchClient('${publicToken}');

export const authenticate = () => {
stytch.webauthn.authenticate({
  session_duration_minutes: 60,
});
};
```

```json 200 theme={null}
{
  "status_code": 200,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "session": null
  "session_jwt": "",
  "session_token": "",
  "user": {...},
  "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
  "webauthn_registration_id": "webauthn-registration-test-5c44cc6a-8af7-48d6-8da7-ea821342f5a6",
}
```

```json 400 theme={null}
{
  "status_code": 400,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "invalid_public_key_credential",
  "error_message": "Invalid public key credential. Please confirm you're passing a correctly formatted public key credential.",
  "error_url": "https://stytch.com/docs/api/errors/400"
}
```

```json 401 theme={null}
{
  "status_code": 401,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "unable_to_auth_webauthn_registration",
  "error_message": "WebAuthn registration could not be authenticated.",
  "error_url": "https://stytch.com/docs/api/errors/401"
}
```

```json 429 theme={null}
{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}
```

```json 500 theme={null}
{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}
```