User Passkey Registered

The user.passkey.registered event is triggered when a user successfully completes the WebAuthn registration ceremony and a new passkey credential is stored against their account. Use this event to drive a “we added a new passkey to your account — wasn’t you?” security notification. The webhook payload carries the credential’s nickname, transports, and backup state so the email or in-app banner can identify which device was added without exposing internal identifiers. Idempotent re-registration (the user retries the same authenticator and the server short-circuits on the duplicate-credential check) does not re-emit the event.

Event payload

Emitted on a successful passkey registration ceremony. Idempotent re-registration of an already-stored credential does not re-fire.

user_id

string

required

An app's user's unique identifier. It is prefixed with 'usr_'

Examples:

"usr_01jqebhswje1ka1z7ahr9rfsgt"

"usr_01jqy7455pf8p9bap5qke912g1"

session_id

string

required

A user's session unique identifier. It is prefixed with 'ses_'

Example:

"ses_01jr0z5w2seq998trz7ftbb9rj"

credential

object

required

Subset of the credential surfaced on user.passkey.* events. Public key, sign count, and AAGUID are intentionally hidden — they are internal to the authentication flow and never relevant to a downstream webhook subscriber.

Show child attributes

registered_at

string<date-time>

required

Example:

"2025-03-15T10:30:00Z"

correlation_id

string

Example:

"123e4567-e89b-12d3-a456-426614174000"

User Passkey Deleted

{
  "user_id": "<string>",
  "session_id": "<string>",
  "credential": {
    "credential_id": "<string>",
    "backup_state": true,
    "nickname": "<string>",
    "transports": [
      "<string>"
    ]
  },
  "registered_at": "2023-11-07T05:31:56Z",
  "correlation_id": "<string>"
}

​Event payload

Event payload