Biometric verification by URL.
Without the camera every time.

curl -X POST https://winkkey.net/api/merchant/auth-request \
  -H "Authorization: Bearer wkey_…" \
  -H "Content-Type: application/json" \
  -d '{
    "ttlSeconds": 900,
    "userHintEmail": "user@example.com",
    "callbackUrl": "https://acme.com/cb"
  }'

# returns:
# { "rid": "Abc…", "url": "https://winkkey.net/v2/stage/auth/Abc…", "expiresAt": … }

curl -X POST https://winkkey.net/api/merchant/auth-request \
  -H "Authorization: Bearer wkey_…" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "enroll",
    "callbackUrl": "https://acme.com/cb"
  }'

# Forces Wink cloud, 2-day TTL by default,
# user is offered a WinkKey passkey post-enrol

curl https://winkkey.net/api/merchant/auth-request/Abc…

# while pending: { "status": "pending", … }
# once consumed:
# {
#   "status": "consumed",
#   "consumedMethod": "winkkey",
#   "winkAccessToken": "eyJ…",
#   "winkAccessTokenExpiresAt": 1745…,
#   "resultToken": "eyJ…",
#   …
# }

window.addEventListener('message', (e) => {
  if (e.origin !== 'https://winkkey.net') return;
  if (e.data?.type !== 'winkkey') return;

  switch (e.data.event) {
    case 'auth-link:done':
      // e.data.token = result JWT
      // e.data.callbackUrl
      break;
    case 'auth-link:cancelled':
    case 'auth-link:mismatch':
    case 'auth-link:invalid':
      // handle terminal failure
      break;
  }
});