Website
Passkeys
Passkeys for your WebsitePublisher account: Touch ID, Face ID, Windows Hello or a hardware security key (YubiKey). Account-scoped: acts on the signed-in user, whichever project you call it on. Flow: status -> start-registration (returns a link) -> the owner opens the link, confirms with a code sent to their account e-mail (first passkey) or with an existing passkey, and creates the passkey there. The first passkey comes with one-time recovery codes, shown on that page only. rename and revoke manage existing passkeys; removing the last passkey and creating new recovery codes return approval_required with a link the owner approves with their passkey. Nothing is completed through this API alone.
Endpoints (6)
Passkeys of the account (id, name, type, synced or device-bound, created, last used), how many recovery codes are left and the passkey settings. Never returns keys or codes.
No input parameters required.
Start adding a passkey. Returns a link (valid 15 minutes) for the owner: they confirm with a code sent to the account e-mail (first passkey) or with an existing passkey or recovery code, then create the passkey in their browser. Give the owner the url; do not open it yourself.
No input parameters required.
Rename a passkey so the owner recognises it (e.g. "MacBook Touch ID", "YubiKey blue").
| Field | Type | Required | Description |
|---|---|---|---|
id |
integer | ✓ Yes | Passkey id from status. |
name |
string | ✓ Yes | New name, max 64 characters. |
Remove a passkey (lost or replaced device). The owner gets a mail. Removing the LAST passkey returns approval_required with a link: the owner approves on that page with the passkey or a recovery code.
| Field | Type | Required | Description |
|---|---|---|---|
id |
integer | ✓ Yes | Passkey id from status. |
New recovery codes (the old unused ones stop working). Returns approval_required with a link: the owner approves with a passkey and sees the new codes on that page, once. The codes never come back through this API.
No input parameters required.
The last 50 security events of the account: passkeys added, renamed or removed, codes sent, recovery codes used, failed attempts.
No input parameters required.
MCP Tool Names
When using this integration through an AI assistant (Claude, ChatGPT, Cursor, etc.), the endpoints are available as MCP tools:
| Endpoint | MCP Tool Name |
|---|---|
| status | passkeys_status |
| start-registration | passkeys_start_registration |
| rename | passkeys_rename |
| revoke | passkeys_revoke |
| regenerate-recovery | passkeys_regenerate_recovery |
| audit | passkeys_audit |