> ## Documentation Index
> Fetch the complete documentation index at: https://gowa-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Submit the WebAuthn assertion for passkey pairing

> Send the WebAuthn assertion produced for the pending challenge (see GET /app/passkey). The assertion must be produced by an authenticator holding the WhatsApp account's passkey, against WhatsApp's relying-party ID; the payload format matches PublicKeyCredential.toJSON(). If the assertion is submitted within the 5-minute handoff window, pairing is confirmed automatically; otherwise a confirmation code is issued (PASSKEY_CONFIRMATION websocket event) and must be confirmed via POST /app/passkey/confirm.




## OpenAPI

````yaml /openapi.yml post /app/passkey/response
openapi: 3.0.0
info:
  title: WhatsApp API MultiDevice
  version: 9.7.0
  description: |
    This API is used for sending whatsapp via API.

    The web dashboard is a separate project (gowa-ui); the server downloads its
    latest release asset and serves it at `/` (or returns a JSON banner when
    APP_UI_ENABLED=false).

    Device scoping:
    - Send `X-Device-Id` on all device-scoped REST calls.
    - WebSocket: connect to `/ws?device_id=<id>`.
    - WebSocket auth (when basic auth is enabled): browsers cannot set an
      Authorization header on WebSocket connections, so also pass
      `&authorization=<base64(user:pass)>` in the query string. Use TLS in
      production since the credential is visible in the URL.
servers:
  - url: http://localhost:3000
security:
  - basicAuth: []
tags:
  - name: app
    description: Initial Connection to Whatsapp server
  - name: device
    description: Device management for multi-device support
  - name: user
    description: Getting information
  - name: send
    description: Send Message (Text/Image/File/Video).
  - name: message
    description: Message manipulation (revoke/react/update).
  - name: call
    description: Call management (reject incoming calls)
  - name: chat
    description: Chat conversations and messaging
  - name: group
    description: Group setting
  - name: newsletter
    description: newsletter setting
  - name: chatwoot
    description: Chatwoot integration for customer support
paths:
  /app/passkey/response:
    post:
      tags:
        - app
      summary: Submit the WebAuthn assertion for passkey pairing
      description: >
        Send the WebAuthn assertion produced for the pending challenge (see GET
        /app/passkey). The assertion must be produced by an authenticator
        holding the WhatsApp account's passkey, against WhatsApp's relying-party
        ID; the payload format matches PublicKeyCredential.toJSON(). If the
        assertion is submitted within the 5-minute handoff window, pairing is
        confirmed automatically; otherwise a confirmation code is issued
        (PASSKEY_CONFIRMATION websocket event) and must be confirmed via POST
        /app/passkey/confirm.
      operationId: appPasskeyResponse
      parameters:
        - $ref: '#/components/parameters/DeviceIdHeader'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebAuthnAssertion'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorBadRequest'
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorInternalServer'
components:
  parameters:
    DeviceIdHeader:
      name: X-Device-Id
      in: header
      required: false
      description: >
        Device identifier for multi-device support. Required when multiple
        devices are registered.

        If only one device is registered, it will be used as the default.

        Can also be provided as `device_id` query parameter.
      schema:
        type: string
        example: my-device-id
  schemas:
    WebAuthnAssertion:
      type: object
      description: >-
        WebAuthn assertion in PublicKeyCredential.toJSON() format (binary fields
        base64url-encoded without padding)
      required:
        - id
        - rawId
        - type
        - response
      properties:
        id:
          type: string
          example: XcnXe2W9me1XZTGii6JI9A
        rawId:
          type: string
          example: XcnXe2W9me1XZTGii6JI9A
        type:
          type: string
          example: public-key
        response:
          type: object
          required:
            - clientDataJSON
            - authenticatorData
            - signature
          properties:
            clientDataJSON:
              type: string
            authenticatorData:
              type: string
            signature:
              type: string
            userHandle:
              type: string
              nullable: true
    GenericResponse:
      type: object
      properties:
        code:
          type: string
          example: SUCCESS
        message:
          type: string
          example: Success
        results:
          type: string
          example: null
    ErrorBadRequest:
      type: object
      properties:
        code:
          type: string
          example: 400
          description: HTTP Status Code
        message:
          type: string
          example: field cannot be blank
          description: Detail error message
        results:
          type: object
          example: null
          description: additional data
    ErrorInternalServer:
      type: object
      properties:
        code:
          type: string
          example: INTERNAL_SERVER_ERROR
          description: SYSTEM_CODE_ERROR
        message:
          type: string
          example: you are not loggin
          description: Detail error message
        results:
          type: object
          example: null
          description: additional data
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.