TypeScript API / @laikacms/server/oauth2 / verifyAuthentication

Function: verifyAuthentication()

function verifyAuthentication(response, config): Promise<{
  cloneWarning?: boolean;
  credentialId?: string;
  error?: string;
  success: boolean;
  userId?: string;
}>;

Verify authentication response

Signature counter semantics (WebAuthn L2 §6.1.1): the counter is a cloning signal, not an authentication gate. A signed assertion whose counter did not increase (common for synced/backup-restored passkeys, and authenticators that always report 0) still succeeds, but cloneWarning is set so callers can feed it into risk scoring. The stored counter is only ever mutated after the signature has verified, and is never decreased — so a forged assertion can never poison the stored counter and lock the credential out.

Parameters

Parameter	Type
response	AuthenticationResponse
config	PasskeyConfig

Returns

Promise<{ cloneWarning?: boolean; credentialId?: string; error?: string; success: boolean; userId?: string; }>