identity

Passkeys (FIDO2)

Phishing-resistant passwordless authentication. SIFIP acts as a delegated FIDO2/WebAuthn server: your domain remains the Relying Party towards the browser, while SIFIP issues challenges, verifies signatures and stores public keys. Every ceremony returns a fraud score and a recommended action, with SIM Swap step-up and eKYC account recovery. None of your end users' personal data is stored.

Simulate an API call

Parameters

Name	Type	Required	Description
ceremony_id	string	required	Identifiant de la cérémonie obtenu via /authentication/options
credential	object	required	AuthenticationResponseJSON renvoyé par navigator.credentials.get()
context.ip	string	optional	IP de l'utilisateur final, hachée avant stockage
context.user_agent	string	optional	User-agent, utilisé comme feature de risque
context.channel	enum	optional	web \| android \| ios
context.msisdn	E.164	optional	Requis uniquement si le step-up SIM Swap est activé. Jamais stocké.

Sample response

{
  "verified": true,
  "user_handle": "u_8f3a2c91",
  "credential_id": "AbC123...",
  "user_verified": true,
  "backup_state": true,
  "risk": {
    "score": 0.82,
    "level": "high",
    "reasons": [
      "new_device_context",
      "sim_swap_recent"
    ]
  },
  "recommended_action": "step_up",
  "stepup": {
    "required": [
      "sim_swap"
    ]
  },
  "result_token": "eyJhbGciOiJFUzI1NiIsImtpZCI6...",
  "verified_at": "2026-10-21T07:42:03Z"
}