# Authentication.getSignPayload

Constructs the final digest that was signed and computed by the authenticator. This payload includes the cryptographic `challenge`, as well as authenticator metadata (`authenticatorData` + `clientDataJSON`). This value can be also used with raw P256 verification (such as `P256.verify` or `WebCryptoP256.verify`).

:::warning
This function is mainly for testing purposes or for manually constructing signing payloads. In most cases you will not need this function and instead use `Authentication.sign`.
:::

## Imports

:::code-group
```ts [Named]
import { Authentication } from 'ox/webauthn'
```

```ts [Entrypoint]
import * as Authentication from 'ox/webauthn/Authentication'
```
:::

## Examples

```ts twoslash
import { Authentication } from 'ox/webauthn'
import { WebCryptoP256 } from 'ox'

const { metadata, payload } = Authentication.getSignPayload(
  {
    // [!code focus]
    challenge: '0xdeadbeef' // [!code focus]
  }
) // [!code focus]

const { publicKey, privateKey } =
  await WebCryptoP256.createKeyPair()

const signature = await WebCryptoP256.sign({
  payload,
  privateKey
})
```

## Definition

```ts
function getSignPayload(
  options: getSignPayload.Options,
): getSignPayload.ReturnType
```

**Source:** [src/webauthn/Authentication.ts](https://github.com/wevm/ox/blob/main/src/webauthn/Authentication.ts#L271)

## Parameters

### options

* **Type:** `getSignPayload.Options`

Options to construct the signing payload.

#### options.challenge

* **Type:** `0x${string}`

The challenge to sign.

#### options.crossOrigin

* **Type:** `boolean`
* **Optional**

If set to `true`, it means that the calling context is an `<iframe>` that is not same origin with its ancestor frames.

#### options.extraClientData

* **Type:** `Record`
* **Optional**

Additional client data to include in the client data JSON.

#### options.flag

* **Type:** `number`
* **Optional**

A bitfield that indicates various attributes that were asserted by the authenticator. [Read more](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Authenticator_data#flags)

#### options.hash

* **Type:** `boolean`
* **Optional**

If set to `true`, the payload will be hashed before being returned.

#### options.origin

* **Type:** `string`
* **Optional**

The fully qualified origin of the relying party which has been given by the client/browser to the authenticator.

#### options.rpId

* **Type:** `string`
* **Optional**

The [Relying Party ID](https://w3c.github.io/webauthn/#relying-party-identifier) that the credential is scoped to.

#### options.signCount

* **Type:** `number`
* **Optional**

A signature counter, if supported by the authenticator (set to 0 otherwise).

#### options.userVerification

* **Type:** `UserVerificationRequirement`
* **Optional**

The user verification requirement that the authenticator will enforce.

## Return Type

The signing payload.

`getSignPayload.ReturnType`