Save Passkey Settings

Saves the project's passkey authentication settings.

Membership settings control how authentication and authorization behave for your project — allowed sign-in methods, registration rules, password complexity, and passkey options.

This endpoint creates the passkey settings; the response returns its id.

Saves the project's passkey authentication settings.

post

Authorizations

Bearer

HTTPRequired

JWT Bearer Authorization

Path parameters

versionstring · nullableRequired

The CodeMash API version used to fetch data from the API. If not specified, the last version will be used. E.g.: v3

Body

multipart/form-dataapplication/json

Saves the project's passkey authentication settings.

enabledbooleanOptional

Whether the email + passkey sign-in flow is enabled for the project.

codeTtlMinutesinteger · int32Optional

Email verification code lifetime, in minutes. Allowed range: 3-15.

maxCredentialsPerUserinteger · int32Optional

Maximum passkeys a single user may register. Allowed range: 1-20.

recoveryCodeCountinteger · int32Optional

Number of recovery codes generated at signup. Allowed range: 5-20.

generateRecoveryCodesAtSignupbooleanOptional

Whether recovery codes are generated automatically at signup.

authenticatorAttachmentstringOptional

Accepted authenticator types: 'Any', 'Platform', or 'CrossPlatform'.

allowMagicLinkRecoverybooleanOptional

Per-project opt-in for magic-link account recovery (off by default).

refreshTokenTtlDaysinteger · int32Optional

Absolute refresh-token lifetime, in days. Allowed range: 7-90.

rpIdstring · nullableOptional

Optional explicit WebAuthn RP-ID — a bare DNS host (e.g. 'app.example.com', no scheme/port/path). Leave null/empty to derive it from the project's CORS origins. WARNING: changing this value invalidates every existing passkey on the project — set it once before going live and avoid changing it afterward.

projectIdstringRequired

ID of your project. Can be passed in a header as norbix-project-id.

envstring · nullableOptional

Target environment for this request (e.g. TEST, STAGING). Optional — when omitted the request runs against PROD. Can be passed in a header as norbix-env.

cultureCodestring · nullableOptional

Specify culture code when your response from the API should be localised. E.g.: en

timeZoneIdstring · nullableOptional

TimeZone

correlationIdstring · nullableOptional

CorrelationId for each request

Responses

200

OK

application/json

post/{version}/membership/passkey/settings

HTTPcURLJavaScriptPython

POST /{version}/membership/passkey/settings HTTP/1.1
Host: hub.norbix.ai
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: multipart/form-data
Accept: */*
Content-Length: 362

{
  "enabled": true,
  "codeTtlMinutes": 1,
  "maxCredentialsPerUser": 1,
  "recoveryCodeCount": 1,
  "generateRecoveryCodesAtSignup": true,
  "authenticatorAttachment": "text",
  "allowMagicLinkRecovery": true,
  "refreshTokenTtlDays": 1,
  "rpId": "text",
  "projectId": "text",
  "env": "text",
  "resolvedEnv": {
    "value": "text",
    "isProd": true
  },
  "cultureCode": "text",
  "timeZoneId": "text",
  "correlationId": "text"
}

multipart/form-dataapplication/json

200

OK

{
  "responseStatus": {
    "isSuccess": true
  }
}

In the dashboard

Manage this visually in Norbix Cloud — see Membership → Settings.

Use it from code

Every Norbix SDK exposes this endpoint as a method — see Save Passkey Settings in the SDK reference, with examples in every language.