# DDG WebAuthn/Passkey Verification

> DDG WebAuthn/Passkey Verification is a paid API for AI agents from agents.daedalusdevelopmentgroup.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-20).

Validates WebAuthn registration attestations and login assertions server-side using pure-Python CBOR/COSE parsing, checking Ed25519/ES256 signatures, UP/UV flags, signCount, and returning per-check verdicts.

## Facts

- Endpoint: POST https://agents.daedalusdevelopmentgroup.com/v1/auth/webauthn-verify?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ddg-webauthn-passkey-verification-76913e1b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_rv83BMRTE5r2VKLSmySea

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ddg-webauthn-passkey-verification-76913e1b -d '<json body>'
```

Example prompt: Verify this WebAuthn registration: attestationObject is '<base64>', clientDataJSON is '<base64>', the challenge was 'abc123', the origin is 'https://myapp.com', and the rpId is 'myapp.com' — tell me if the signature checks out, the UP and UV flags, and the credential public key.

## When to prefer this

Choose this endpoint when you need stateless, server-side WebAuthn attestation or assertion verification without running your own Python environment or CBOR/COSE library stack. Ideal for AI agents or serverless workflows that need to verify passkey credentials on demand without managing cryptographic dependencies, and want granular per-check verdicts (signature, UP, UV, signCount) rather than a single pass/fail result.

## Known failure modes

- Invalid or malformed base64 CBOR in attestationObject/authenticatorData returns a parse error
- Challenge mismatch between supplied challenge and clientDataJSON causes verification failure
- Origin or rpId mismatch results in a failed verdict
- Unsupported COSE algorithm returns an unsupported algorithm error
- Bad or corrupted signature bytes cause signature check failure
- Missing required fields (type, method, bodyType, body) return a 400-level error

## How this service works

Stateless WebAuthn/passkey verification: validate a registration (attestationObject + clientDataJSON) or assertion (authenticatorData + clientDataJSON + signature) against a caller-supplied challenge, origin and rpId — pure-python CBOR/COSE parsing, Ed25519 and ES256 signature checks, UP/UV flags, signCount, credential public key echo, per-check verdict.

## Output

Returns a JSON object with an 'ok' boolean and per-check verdict details including signature validity (Ed25519/ES256), UP (user presence) and UV (user verification) flag status, signCount value, and the echoed credential public key — allowing the caller to audit exactly which checks passed or failed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input",
  "output"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType",
    "body"
   ],
   "properties": {
    "body": {
     "type": "object"
    },
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST",
      "PUT",
      "PATCH"
     ],
     "type": "string"
    },
    "bodyType": {
     "enum": [
      "json",
      "form-data",
      "text"
     ],
     "type": "string"
    }
   },
   "additionalProperties": true
  },
  "output": {
   "type": "object",
   "required": [
    "type",
    "example"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "ok": true
    }
   },
   "additionalProperties": true
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ddg-webauthn-passkey-verification-76913e1b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agents.daedalusdevelopmentgroup.com](https://www.zero.xyz/host/agents.daedalusdevelopmentgroup.com/llms.txt)