Continue step-up challenge
Verify the customer’s verification token and advance the challenge to the next step. A valid DPoP proof (DPoP header, RFC 9449) is required on every call to this endpoint.
Authorizations
Access token obtained from session refresh
Body
Response
OK
The updated challenge token for the next step or final grant.
"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."
WebAuthn PublicKeyCredentialRequestOptions in the WebAuthn Level 3
JSON form (binary fields are base64url-encoded). Present only when the
step-up step the response advanced to is verify_passkey; pass it to
navigator.credentials.get({ publicKey }). The frontend SDKs cache it
keyed on the challenge id and run the assertion automatically.