# `Ithibati.Web.Router`
[🔗](https://github.com/oliverandrich/ithibati/blob/v0.6.2/lib/ithibati/web/router.ex#L3)

Mounts registration, authentication and recovery endpoints in a Phoenix router.

Import this module and use a pipeline that accepts JSON, fetches the session and checks CSRF:

    pipeline :ceremony do
      plug :accepts, ["json"]
      plug :fetch_session
      plug :protect_from_forgery
    end

    scope "/auth" do
      pipe_through :ceremony
      ithibati_routes handler: MyAppWeb.Auth, rp_name: "MyApp"
    end

The mount adds five POST paths relative to its scope: `/registration/challenge`,
`/registration`, `/authentication/challenge`, `/authentication` and `/recovery`.
Their suffixes are fixed; the application chooses the scope prefix.

# `ithibati_routes`
*macro* 

Generates the five POST routes with settings local to this mount.

## Options

  * `:handler` — required module implementing `Ithibati.Web.Handler`.
  * `:rp_name` — required relying-party display name for passkey dialogs.
  * `:user_verification` — `"required"`, `"preferred"` (default) or `"discouraged"`.
  * `:seconds` — positive integer challenge lifetime; defaults to `60`.

Different mounts can use different handlers and ceremony settings. The controller derives the
relying-party ID and origin from the endpoint unless the handler overrides `relying_party/2`.

A handler alias is resolved without introducing a compile-time dependency on that handler.

---

*Consult [api-reference.md](api-reference.md) for complete listing*