{"uid":"cap_rv83BMRTE5r2VKLSmySea","slug":"ddg-webauthn-passkey-verification-76913e1b","name":"DDG WebAuthn/Passkey Verification","description":"Stateless WebAuthn/passkey verification: validate a registration (attestationObject + clientDataJSON) or assertion (authenticatorData + clientDataJSON + signature) against a caller-supplied challenge, origin and rpId — pure-python CBOR/COSE parsing, Ed25519 and ES256 signature checks, UP/UV flags, signCount, credential public key echo, per-check verdict.","url":"https://agents.daedalusdevelopmentgroup.com/v1/auth/webauthn-verify?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input","output"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object"},"type":{"type":"string","const":"http"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":true},"output":{"type":"object","required":["type","example"],"properties":{"type":{"type":"string"},"example":{"ok":true}},"additionalProperties":true}}},"responseSchema":{"type":"json","example":{"ok":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_JjCAv67NgA_8PpSA20ZBj","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates WebAuthn registration attestations and login assertions server-side using pure-Python CBOR/COSE parsing, checking Ed25519/ES256 signatures, UP/UV flags, signCount, and returning per-check verdicts.","exampleAgentPrompt":"Verify this WebAuthn registration: attestationObject is '<base64>', clientDataJSON is '<base64>', the challenge was 'abc123', the origin is 'https://myapp.com', and the rpId is 'myapp.com' — tell me if the signature checks out, the UP and UV flags, and the credential public key.","exampleUseCases":[{"title":"Passkey login assertion validation","prompt":"A user just logged in with their passkey — can you verify the assertion? authenticatorData is '<base64>', clientDataJSON is '<base64>', signature is '<base64>', the original challenge was 'ch_xyz789', origin is 'https://myapp.com', and rpId is 'myapp.com'. Tell me if each check passes and what the signCount came back as."},{"title":"New passkey registration attestation check","prompt":"A new user registered a passkey on my site and I need to verify the attestation before saving it. The attestationObject is '<base64>', clientDataJSON is '<base64>', the challenge I issued was 'reg_chall_001', origin is 'https://accounts.example.com', and rpId is 'example.com'. Does the signature verify and what credential public key should I store?"},{"title":"Detecting replayed or tampered passkey responses","prompt":"Can you run a WebAuthn assertion verification and specifically report the signCount and UP/UV flags? authenticatorData '<base64>', clientDataJSON '<base64>', signature '<base64>', challenge 'nonce_555', origin 'https://secure.mybank.com', rpId 'mybank.com' — I want to know if anything looks like a replay attack."}],"resultDescription":"Returns a JSON object with an 'ok' boolean and per-check verdict details including signature validity (Ed25519/ES256), UP (user presence) and UV (user verification) flag status, signCount value, and the echoed credential public key — allowing the caller to audit exactly which checks passed or failed.","failureModes":["Invalid or malformed base64 CBOR in attestationObject/authenticatorData returns a parse error","Challenge mismatch between supplied challenge and clientDataJSON causes verification failure","Origin or rpId mismatch results in a failed verdict","Unsupported COSE algorithm returns an unsupported algorithm error","Bad or corrupted signature bytes cause signature check failure","Missing required fields (type, method, bodyType, body) return a 400-level error"],"whenToPreferThis":"Choose this endpoint when you need stateless, server-side WebAuthn attestation or assertion verification without running your own Python environment or CBOR/COSE library stack. Ideal for AI agents or serverless workflows that need to verify passkey credentials on demand without managing cryptographic dependencies, and want granular per-check verdicts (signature, UP, UV, signCount) rather than a single pass/fail result.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T12:34:16.922Z","isFirstParty":false,"canonicalSlug":"ddg-webauthn-passkey-verification-76913e1b"}