Wraps the register_start and register WebAuthn endpoints and the navigator.credentials web API. Call this method to prompt the user to enroll a new WebAuthn factor and save the factor in Stytch. Call webauthn.register inside an event callback triggered by a user gesture.
If a user has enrolled another MFA method, this method will require MFA. See the Multi-factor authentication section for more details.
The requested authenticator type of the Passkey or WebAuthn device. The two valid values are platform and cross-platform. If no value passed, we assume both values are allowed.
The desired name for the user key in the public_key_credential_creation_options response field. The default is the User’s name, email, or phone number.
The desired display_name for the user key in the public_key_credential_creation_options response field. The default is the User’s name, email, or phone number.
Set the session lifetime to be this many minutes from now. This will start a new session if one doesn’t already exist, returning both an opaque session_token and session_jwt for this session. Remember that the session_jwt will have a fixed lifetime of five minutes regardless of the underlying session duration, and will need to be refreshed over time. This value must be a minimum of 5 and a maximum of 527040 minutes (366 days). If a session_token or session_jwt is provided then a successful authentication will continue to extend the session this many minutes. If the session_duration_minutes parameter is not specified, a Stytch session will not be created.
The trusted_metadata field contains an arbitrary JSON object of application-specific data. See the Metadata reference for complete field behavior details.
The untrusted_metadata field contains an arbitrary JSON object of application-specific data. Untrusted metadata can be edited by end users directly via the SDK, and cannot be used to store critical information. See the Metadata reference for complete field behavior details.
If available, the profile_picture_url is a url of the User’s profile picture set in OAuth identity the provider that the User has authenticated with, e.g. Facebook profile picture.
The authenticator_type string displays the requested authenticator type of the Passkey or WebAuthn device. The two valid types are “platform” and “cross-platform”. If no value is present, the Passkey or WebAuthn device was created without an authenticator type preference.
If you initiate a Session, by including session_duration_minutes in your authenticate call, you’ll receive a full Session object in the response. See Session object for complete response fields.
If Protected Auth is enabled and returned fingerprinting results, the user_device response field will contain information about the user’s device attributes.
Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we
may ask for this value to help identify a specific API call when helping you debug an issue.
The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values
equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.