Hanko API

Name: Hanko API
Brand: Hanko API
Availability: InStock

✓ Official Vendor SpecIdentity AuthAuthenticationbearer, apiKey11 EndpointsREST

For Agents

Run passkey, WebAuthn, and email OTP authentication flows and manage users and audit logs through a flow-based REST API.

Install Jentic One Beta

Connect the Hanko API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Hanko API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Hanko API.

Drive a passkey-first registration, login, or profile flow through a single state machine endpoint

Issue and verify JWTs via the standard JWKS endpoint for downstream services

Send and verify email OTP passcodes as a fallback for passkey-less devices

GET STARTED

Start building with Hanko API

Explore with Jentic

View OpenAPI Document

Hanko is an open-source authentication platform built around passkeys and WebAuthn, with passcode email OTP fallback and a flow-based state machine that drives registration, login, and profile updates. The public API exposes 11 endpoints split between user-facing authentication flows and an admin API for managing users and audit logs. End-user calls return short-lived JWTs verifiable against the JWKS endpoint, while admin endpoints require an API key in the Authorization header. The flow-based design lets a single endpoint advance multiple authentication steps without bespoke client logic.

Use Cases

Patterns agents use Hanko API for, with concrete tasks.

★ Passkey-First Sign-Up

Replace passwords with passkeys for new users by initiating POST /registration and advancing the returned flow_id through POST /flow/{action}. Hanko walks the client through WebAuthn credential creation and returns a JWT once the flow completes. The whole sign-up takes a few round trips and no password is ever stored.

Initiate a Hanko registration flow for email 'new@example.com' via POST /registration, then advance the returned flow_id through POST /flow/submit_email.

Email OTP Fallback Login

When a user is on a device without a registered passkey, fall back to email OTP by initiating POST /login and using the flow state machine to send and verify a passcode. Hanko issues a JWT on success that the client stores and presents on subsequent API calls. The same /login endpoint handles passkey, OTP, and SSO branches without separate URLs.

Begin a login flow at POST /login for 'user@example.com', then call POST /flow/send_passcode and POST /flow/verify_passcode with the user's code.

Admin User Management

Provision and offboard users from a back-office tool by calling /admin/users with an admin API key. Use POST /admin/users to add a user, GET /admin/users to list, GET /admin/users/{user_id} to inspect, and DELETE /admin/users/{user_id} to remove. The admin surface is separate from the end-user flow API and uses a different credential type.

Delete user with ID 'a1b2c3' via DELETE /admin/users/a1b2c3 and confirm by listing users via GET /admin/users.

AI Agent Identity Helper

Let an AI agent provision developer accounts for a sandbox environment by calling /admin/users through Jentic. The admin API key sits in the Jentic vault and is injected as the Authorization header per call, so the agent context only sees a tool result. The agent cannot bypass passkey verification — that always happens client-side via WebAuthn.

When asked 'create a sandbox user for jane@example.com', call POST /admin/users with the email and return the new user_id.

Key Endpoints

11 endpoints — hanko is an open-source authentication platform built around passkeys and webauthn, with passcode email otp fallback and a flow-based state machine that drives registration, login, and profile updates.

METHOD

PATH

DESCRIPTION

POST

/registration

Initiate a registration flow

POST

/login

Initiate a login flow

POST

/profile

Initiate a profile management flow

POST

/flow/{action}

Advance a flow with a specific action

GET

/.well-known/jwks.json

Public JWKS for verifying issued JWTs

GET

/admin/users

List users (admin)

POST

/admin/users

Create a user (admin)

GET

/admin/audit_logs

List authentication audit logs

POST

/registration

Initiate a registration flow

POST

/login

Initiate a login flow

POST

/profile

Initiate a profile management flow

POST

/flow/{action}

Advance a flow with a specific action

GET

/.well-known/jwks.json

Public JWKS for verifying issued JWTs

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Hanko admin API keys are stored in the Jentic vault and injected as the Authorization header only on /admin/* endpoints. End-user JWTs are passed through per request and never logged into the agent's transcript.

Intent-based discovery

Agents search Jentic for 'start a passkey login flow' and Jentic returns POST /login plus the /flow/{action} continuation, so the agent does not need to crawl docs.hanko.io.

Time to first call

Direct integration: 1-2 days to model the flow state machine and admin user CRUD. Through Jentic: under 30 minutes.

FAQs

Specific to using Hanko API through Jentic.

What authentication does the Hanko API use?

Hanko uses two schemes: end-user flows return a JWT bearer token verifiable against /.well-known/jwks.json, and admin endpoints require an API key in the Authorization header. Through Jentic the admin API key is stored encrypted in the vault and only injected for /admin/* calls.

Can I sign up new users with passkeys via the Hanko API?

Yes. POST /registration starts a flow that walks the client through WebAuthn credential creation. Each step is advanced via POST /flow/{action} using the flow_id returned by the previous response, and a JWT is issued on completion.

What are the rate limits for the Hanko API?

Hanko Cloud applies fair-use throttling per tenant; specific per-second limits are not published in the OpenAPI spec. The /flow/{action} endpoint enforces stricter limits per flow_id to prevent OTP brute-forcing. Build clients to back off on HTTP 429.

How do I list users in my Hanko tenant through Jentic?

Search Jentic for 'list hanko users', load the schema for GET /admin/users, and execute. Jentic injects the admin API key as the Authorization header. Run pip install jentic and use the async client.search, client.load, and client.execute pattern.

Does Hanko support social SSO providers like Google or Apple?

Hanko's flow-based API supports SSO branches alongside passkeys and email OTP, configured per tenant through the dashboard. The /flow/{action} endpoint advances the flow regardless of which method the user picked, so a single integration handles all enabled methods.

Hanko API

Connect the Hanko API to your agent

Capabilities

Start building with Hanko API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs