add Embedded Wallet PASSKEY reauth

[DhruvPareek]

Extends POST /auth/credentials/{id}/challenge to cover PASSKEY reauthentication. Previously the endpoint only covered EMAIL_OTP (re-send OTP email → plain AuthMethod response). The PASSKEY flow needs a fresh Grid-issued WebAuthn challenge on each reauth — this PR returns that challenge in the 200 response via the discriminated AuthCredentialResponseOneOf shape introduced earlier in the stack.

Flow (PASSKEY)

1. POST /auth/credentials/{id}/challenge → 200 PasskeyAuthChallenge (AuthMethod fields + challenge, requestId, expiresAt).
2. Client runs navigator.credentials.get() against the Grid-issued challenge.
3. Client submits the assertion to POST /auth/credentials/{id}/verify with Request-Id: <requestId>.
4. Verify returns a session.

Wire-up

• openapi/paths/auth/auth_credentials_{id}_challenge.yaml — 200 response $ref swapped from AuthMethod to AuthCredentialResponseOneOf. Added per-type examples (EMAIL_OTP plain AuthMethod; PASSKEY PasskeyAuthChallenge).
• Endpoint description expanded to cover both branches: EMAIL_OTP triggers a new OTP email, PASSKEY issues a fresh Grid-generated challenge
• Summary updated from "Resend an authentication credential challenge" to "Re-issue an authentication credential challenge", more accurate across both branches.
• No new schemas introduced; the oneOf and PasskeyAuthChallenge both come from the create-endpoint PR earlier in the stack.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ready	Preview, Comment	Apr 23, 2026 3:26am

[DhruvPareek]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• refactor: migrate AuthCredentialAdditionalChallenge onto SignedRequestChallenge base #373
• add POST /internal-accounts/{id}/export to export wallet credentials #372
• add DELETE /auth/sessions/{id} to revoke authentication sessions #371
• add GET /auth/sessions to list authentication sessions #370
• add DELETE /auth/credentials/{id} to revoke authentication credentials #369
• add GET /auth/credentials to list authentication credentials #368
• add Embedded Wallet PASSKEY reauth #377 👈 (View in Graphite)
• add Embedded Wallet PASSKEY credential to additional credential flow #365
• add Embedded Wallet PASSKEY auth credential verify #364
• add Embedded Wallet PASSKEY auth credential create #363
• add Embedded Wallet OAUTH credential to additional credential flow #362
• add Embedded Wallet OAUTH credential verify #361
• add Embedded Wallet OAUTH credential create #360
• modify /quotes and /quote/{quoteId}/execute for Embedded Wallet transfers #356
• add Embedded Wallet Auth endpoint for Email OTP challenge #350
• add Embedded Wallet Auth endpoints for Email OTP create + verify #349
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

✱ Stainless preview builds

This PR will update the grid SDKs with the following commit messages.

kotlin

feat(types): convert CredentialResendChallengeResponse to AuthMethod/PasskeyAuthChallenge union

openapi

feat(api): update response type for auth credential challenge endpoint

python

feat(api): add passkey challenge fields to credentials resend_challenge response

typescript

feat(api): add challenge/requestId/expiresAt to auth.credentials.resend_challenge response

Edit this comment to update them. They will appear in their respective SDK's changelogs.

✅ grid-python studio · code · diff

Your SDK build had at least one new note diagnostic, which is a regression from the base state.
generate ❗ → build ✅ → lint ✅ → test ✅

pip install https://pkg.stainless.com/s/grid-python/1d84b151409eaf543433268e413b1d33f1668c39/grid-0.0.1-py3-none-any.whl

New diagnostics (2 note)

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/AuthMethod`

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/PasskeyAuthChallenge`

⚠️ grid-typescript studio · code · diff

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ❗ → build ❗ → lint ❗ (prev: lint ✅) → test ✅

New diagnostics (2 note)

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/AuthMethod`

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/PasskeyAuthChallenge`

✅ grid-openapi studio · code · diff

Your SDK build had at least one new note diagnostic, which is a regression from the base state.
generate ❗

New diagnostics (2 note)

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/AuthMethod`

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/PasskeyAuthChallenge`

⏳ grid-kotlin studio · code · diff

generate ❗ → build ⏳ → lint ✅ → test ⏳

New diagnostics (2 note)

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/AuthMethod`

💡 Model/Recommended: We recommend you use a model for `#/components/schemas/PasskeyAuthChallenge`

⏳ These are partial results; builds are still running.

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-04-23 03:36:41 UTC

[greptile-apps]

Greptile Summary

Extends POST /auth/credentials/{id}/challenge to handle PASSKEY credentials by swapping the 200 response schema from the bare AuthMethod to the discriminated AuthCredentialResponseOneOf (already registered by the prior stack PR), and adds per-type OpenAPI examples for both EMAIL_OTP and PASSKEY branches. The source YAML, root bundle, and Mintlify bundle are all consistently updated.

Confidence Score: 5/5

Safe to merge — the only finding is a cosmetic typo in an example value.

All three changed files are OpenAPI spec/bundle updates with no logic code. The schema wiring correctly references the AuthCredentialResponseOneOf discriminated union and its constituent schemas. The sole issue is a capitalisation typo in an example nickname ("Iphone Face-Id"), which is P2 and does not affect correctness, validation, or runtime behaviour.

No files require special attention beyond the minor typo in the passkey example in openapi/paths/auth/auth_credentials_{id}_challenge.yaml.

Important Files Changed

Filename	Overview
openapi/paths/auth/auth_credentials_{id}_challenge.yaml	Source endpoint definition updated: schema ref swapped to AuthCredentialResponseOneOf, description expanded for both EMAIL_OTP and PASSKEY branches, per-type examples added. Minor typo in passkey example nickname ("Iphone Face-Id" → "iPhone Face-ID").
openapi.yaml	Generated bundle — identical change as the source YAML; regenerated via make build as described. No independent issues beyond the typo mirrored from the source.
mintlify/openapi.yaml	Mintlify-specific generated bundle — same delta as openapi.yaml, regenerated correctly via make build.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Grid API

    Note over Client,Grid API: PASSKEY reauthentication flow
    Client->>Grid API: POST /auth/credentials/{id}/challenge
    Grid API-->>Client: 200 PasskeyAuthChallenge<br/>(challenge, requestId, expiresAt)
    Client->>Client: navigator.credentials.get(challenge)
    Client->>Grid API: POST /auth/credentials/{id}/verify<br/>Request-Id: requestId
    Grid API-->>Client: 200 Session

    Note over Client,Grid API: EMAIL_OTP reauthentication flow
    Client->>Grid API: POST /auth/credentials/{id}/challenge
    Grid API-->>Client: 200 AuthMethod (OTP sent out-of-band)
    Note right of Client: User receives OTP via email
    Client->>Grid API: POST /auth/credentials/{id}/verify<br/>(OTP in request body)
    Grid API-->>Client: 200 Session

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: openapi/paths/auth/auth_credentials_{id}_challenge.yaml
Line: 65

Comment:
**Typo in passkey example `nickname`**

`Iphone Face-Id` should use Apple's official product naming: `iPhone Face-ID`. The incorrect capitalisation ("Iphone", "Face-Id") will be shown verbatim in generated docs/SDKs and looks like an error to developers who know the trademark.

```suggestion
                nickname: iPhone Face-ID
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "feat: add PASSKEY branch to /challenge r..." | Re-trigger Greptile}