Corbado Backend API

Name: Corbado Backend API
Brand: Corbado Backend API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationbasic45 EndpointsREST

For Agents

Manage passkey-based authentication on the Corbado backend, including users, sessions, WebAuthn challenges, identifiers and SSO connections.

Install Jentic One Beta

Connect the Corbado Backend API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Corbado Backend API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Corbado Backend API.

Create or update a user record and attach login identifiers like email or username

Issue a WebAuthn challenge and update its state during a passkey ceremony

List and revoke passkeys registered to a specific user

GET STARTED

Start building with Corbado Backend API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for Corbado Backend API, keeping it validated and agent-ready. Corbado provides a passkey-first authentication backend that lets applications register users, issue WebAuthn challenges, manage passkeys and connect tokens, and query auth and passkey events for security analytics. The 45 endpoints cover users, sessions, identifiers, passkeys, SSO, project configuration, webhook endpoints and password manager hints, plus device and client environment tracking. The API uses HTTP Basic authentication where the username is the Corbado project ID and the password is the API secret.

Use Cases

Patterns agents use Corbado Backend API for, with concrete tasks.

★ Passwordless Sign-Up Flow

Consumer apps replacing passwords with passkeys can wire sign-up to Corbado by creating a user and attaching an identifier (email or username), then issuing a passkey registration challenge. POST /users creates the account, POST /users/{userID}/identifiers attaches the email, and POST /users/{userID}/challenges drives the WebAuthn ceremony.

POST /users with email 'jane@example.com', POST /users/{userID}/identifiers attaching the email, then POST /users/{userID}/challenges to start passkey registration.

Step-Up Authentication for Sensitive Actions

Fintech and health apps that need step-up auth before transfers or record changes can use Corbado connect tokens. The backend creates a connect token tied to the user and action, the frontend prompts a passkey ceremony, and a returned challenge result confirms the user authorised the operation before it executes.

Create a connect token for user 'usr_123' tied to 'wire-transfer-9999' and return the token to the frontend for the WebAuthn step-up flow.

Auth Analytics and Suspicious-Login Triage

Security teams can query Corbado's auth events and passkey events to investigate suspicious sign-ins, list per-user passkeys, and revoke compromised credentials. Combined with the device tracking endpoints this gives a per-user authentication footprint for triage.

List passkey events for user 'usr_456' over the last 30 days, then DELETE the passkey ID flagged as registered from an unfamiliar device.

AI Agent Identity Operations

An admin-side AI agent can answer support tickets like 'remove the lost passkey from my account' by calling Corbado through Jentic. The agent searches by intent, loads the schema for passkey deletion, and executes against the matching path while Jentic keeps the project-id and API secret in the credential vault.

Use Jentic to list passkeys for the user, identify the one matching the device the user reported lost, and DELETE it.

Key Endpoints

45 endpoints — jentic publishes the only available openapi specification for corbado backend api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/users

Create a new user

GET

/users

List users

GET

/users/{userID}

Retrieve a user

PATCH

/users/{userID}

Update a user

POST

/users/{userID}/challenges

Create a passkey challenge for a user

POST

/users/{userID}/identifiers

Attach a login identifier to a user

DELETE

/users/{userID}

Delete a user

POST

/users

Create a new user

GET

/users

List users

GET

/users/{userID}

Retrieve a user

PATCH

/users/{userID}

Update a user

POST

/users/{userID}/challenges

Create a passkey challenge for a user

POST

/users/{userID}/identifiers

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Corbado Basic auth combines the project ID with the API secret. Jentic stores both in the credential vault and constructs the Basic header at execution time, so neither value is exposed in agent reasoning context and per-project credentials stay isolated.

Intent-based discovery

Agents search Jentic with intents like 'create Corbado user' or 'revoke passkey' and Jentic returns the matching path under /v2 plus the request body schema, mapping passkey, challenge and identifier sub-resources to the correct user-scoped operation.

Time to first call

Direct integration: 3-5 days to wire up user creation, WebAuthn challenge state machine, identifier handling and webhook receivers. Through Jentic: under an hour from signup to first user created.

FAQs

Specific to using Corbado Backend API through Jentic.

Why is there no official OpenAPI spec for Corbado Backend API?

Corbado does not publish an OpenAPI specification at this URL. Jentic generates and maintains this spec so that AI agents and developers can call Corbado Backend API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Corbado Backend API use?

The backend API uses HTTP Basic authentication. The username is the Corbado project ID and the password is the API secret. Jentic stores the project ID and secret in the credential vault and constructs the Basic header at execution time.

Can I register a passkey for a new user with the Corbado Backend API?

Yes. Create the user with POST /users, attach an identifier with POST /users/{userID}/identifiers, then drive the WebAuthn registration ceremony with POST /users/{userID}/challenges and PATCH /users/{userID}/challenges/{challengeID} to update the challenge state.

How do I revoke a passkey on the Corbado Backend API?

DELETE the passkey resource for the user (under the Passkeys tag in the spec). For audit context, list PasskeyEvents for the same user first to confirm which credential was used from the suspicious device before revoking.

What rate limits apply to the Corbado Backend API?

The OpenAPI spec does not declare formal rate limits. Treat WebAuthn challenge endpoints as user-driven (one per ceremony) and back off on HTTP 429 with exponential delay during bulk operations.

How do I create a Corbado user through Jentic with the Corbado Backend API?

Run pip install jentic, search Jentic with 'create Corbado user', load the operation schema for POST /users and execute it with the user's email or username; the project ID and API secret are injected by Jentic from the vault.

Corbado Backend API

Connect the Corbado Backend API to your agent

Capabilities

Start building with Corbado Backend API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs