Finish WebAuthn Registration - Pacifica

POST /api/v1/account/2fa/webauthn/register/finish

Finishes registering a passkey or a security key. Call it after Begin WebAuthn registration. When this call succeeds, two-factor authentication is on. Pacifica accepts passkeys only from the Pacifica app. See Passkeys and security keys.

Operation Type (for Signing)

Header Field	Type	Content
`"type"`	string	`"finish_webauthn_registration"`

Request Body

Field	Type	Need	Description	Example
`”account”`	string	required	User’s wallet address	`42trU9A5…`
`“signature”`	string	required	Cryptographic signature	`5j1Vy9Uq…`
`“timestamp”`	integer	required	Current timestamp in milliseconds	`1716200000000`
`”challenge_id”`	string	required	Challenge ID (UUID) from Begin WebAuthn registration	`45c48cce-2e2d-4fbd-8f3b-7a1c9e0d5b62`
`”credential”`	object	required	The credential from `navigator.credentials.create()` as JSON, with binary values as base64url strings. Not part of the signed payload	See below
`”expiry_window”`	integer	optional	Signature expiry in milliseconds	`30000`

{
  "account": "42trU9A5...",
  "signature": "5j1Vy9Uq...",
  "timestamp": 1716200000000,
  "challenge_id": "45c48cce-2e2d-4fbd-8f3b-7a1c9e0d5b62",
  "credential": {
    "id": "pQx3...",
    "rawId": "pQx3...",
    "type": "public-key",
    "response": {
      "attestationObject": "o2NmbXRk...",
      "clientDataJSON": "eyJ0eXBl..."
    }
  },
  "expiry_window": 30000
}

Sign this request with the account’s own key. Agent wallets cannot sign it. The account must be a main account. This call needs no proof. Begin WebAuthn registration already checked it. The challenge works once. If this call fails, start again with Begin WebAuthn registration.

Signing

Sign challenge_id as the data object. Do not sign credential. For the request above, the message to sign is:

{"data":{"challenge_id":"45c48cce-2e2d-4fbd-8f3b-7a1c9e0d5b62"},"expiry_window":30000,"timestamp":1716200000000,"type":"finish_webauthn_registration"}

Response

Status 200: Passkey or security key added

{
  "success": true,
  "data": {
    "recovery_keys": []
  },
  "error": null,
  "code": null
}

Field	Type	Description
`'recovery_keys'`	array	New recovery keys. 10 keys for your first factor. Empty when 2FA was already on

Pacifica shows recovery keys only once. Store them somewhere safe.

Status 400: Invalid request parameters or signature
Status 401: The credential is not valid, or the challenge is unknown, expired, or already used
Status 403: The account is a subaccount, or it does not exist
Status 422: The registration does not fit the account. The error field says why:

`error`	Meaning
`credential is already registered`	This passkey or security key is already a factor
`the authenticator must verify the user with a PIN or biometric`	The authenticator did not verify the user
`two-factor settings changed. Start again.`	A factor change ended this registration
`a user can have at most 8 factors`	The account already has 8 factors

Status 500: Internal server error
Status 503: The two-factor service is unavailable. Retry later

Code Example (Python)

import requests

payload = {
    "account": "42trU9A5...",
    "signature": "5j1Vy9Uq...",
    "timestamp": 1716200000000,
    "challenge_id": "45c48cce-2e2d-4fbd-8f3b-7a1c9e0d5b62",
    "credential": credential  # from navigator.credentials.create() in the Pacifica app
}

response = requests.post(
    "/api/v1/account/2fa/webauthn/register/finish",
    json=payload,
    headers={"Content-Type": "application/json"}
)

data = response.json()