docs: allow multiple passkey credentials

Summary:

- Update auth credential OpenAPI source to describe one EMAIL_OTP credential and multiple distinct PASSKEY credentials.
- Update PASSKEY_CREDENTIAL_ALREADY_EXISTS docs to mean duplicate WebAuthn credentialId rather than one-passkey-per-account.
- Update Global Accounts authentication docs to recommend backup credentials including additional passkeys.
- Rebuild bundled openapi.yaml and mintlify/openapi.yaml.

Test Plan:

- make build
- make lint
- git diff --check

Author: DhruvPareek

mintlify/openapi.yaml

@@ -6,7 +6,7 @@ Every Global Account action beyond receiving funds must be authorized by a sessi
 | **`OAUTH`** | Your platform already authenticates the user via OIDC (Google, Apple, your own IdP) and you want Grid to trust the same identity. |
 | **`EMAIL_OTP`** | Lowest-friction option. Works on any device with email access — no biometric hardware, identity provider, or client SDK required beyond the code entry field. |
 
-A single internal account can hold one credential of each type concurrently. Only one `PASSKEY` and one `EMAIL_OTP` per account in v1.
+A single internal account can hold one `EMAIL_OTP` credential and multiple distinct `PASSKEY` credentials concurrently. `OAUTH` credentials can be added for each supported provider identity.
 
 ## Registration vs. verification
 
@@ -505,7 +505,7 @@ Same pattern as the first activation: call `/challenge` to send a new OTP, then
 
 ## Managing credentials
 
-Every Global Account starts with a single credential — the one used in the <a href="overview#quickstart">quickstart</a>. In production, encourage customers to register a second credential of a different type (e.g., an email OTP alongside a passkey) so the account is recoverable if their primary device is lost. Adding, revoking, and rotating credentials after the first all go through the same **two-step signed-retry** pattern.
+Every Global Account starts with a single credential — the one used in the <a href="overview#quickstart">quickstart</a>. In production, encourage customers to register a backup credential, such as another passkey or an email OTP, so the account is recoverable if their primary device is lost. Adding, revoking, and rotating credentials after the first all go through the same **two-step signed-retry** pattern.
 
 ### List credentials
 
@@ -622,7 +622,7 @@ Requires an active session on an *existing* credential on the same account. The
 </Steps>
 
 <Note>
-  Only one credential of each type (`EMAIL_OTP`, `PASSKEY`) is allowed per internal account in v1. Registering a second credential of the same type returns `400 EMAIL_OTP_CREDENTIAL_ALREADY_EXISTS` or `400 PASSKEY_CREDENTIAL_ALREADY_EXISTS`.
+  Only one `EMAIL_OTP` credential is allowed per internal account. Multiple distinct `PASSKEY` credentials are allowed; registering the same WebAuthn credentialId twice returns `400 PASSKEY_CREDENTIAL_ALREADY_EXISTS`.
 </Note>
 
 ### Revoke a credential

mintlify/snippets/global-accounts/authentication.mdx

@@ -48,7 +48,7 @@ properties:
       | UNSUITABLE_DOCUMENT | Document type is not accepted or not supported |
       | INCOMPLETE | Document is missing pages or sides |
       | EMAIL_OTP_CREDENTIAL_ALREADY_EXISTS | An EMAIL_OTP credential is already registered on the target internal account; only one email OTP credential is supported per internal account at this time |
-      | PASSKEY_CREDENTIAL_ALREADY_EXISTS | A PASSKEY credential is already registered on the target internal account; only one passkey credential is supported per internal account in v1 |
+      | PASSKEY_CREDENTIAL_ALREADY_EXISTS | A PASSKEY credential with the same WebAuthn credentialId is already registered on the target internal account |
     enum:
       - INVALID_INPUT
       - MISSING_MANDATORY_USER_INFO

openapi.yaml

@@ -7,8 +7,9 @@ post:
     Embedded Wallet internal accounts are initialized with an `EMAIL_OTP`
     credential tied to the customer email on the account. Use this endpoint
     to add another credential (`OAUTH` or `PASSKEY`), or to add `EMAIL_OTP`
-    back after it has been removed. Only one `EMAIL_OTP` credential and one
-    `PASSKEY` credential are supported per internal account.
+    back after it has been removed. Only one `EMAIL_OTP` credential is
+    supported per internal account; multiple distinct `PASSKEY` credentials
+    may be registered.
 
 
     Adding a credential requires a signature from an existing verified
@@ -160,11 +161,10 @@ post:
                 expiresAt: '2026-04-08T15:35:00Z'
     '400':
       description: >-
-        Bad request. Returned with `EMAIL_OTP_CREDENTIAL_ALREADY_EXISTS` or
-        `PASSKEY_CREDENTIAL_ALREADY_EXISTS` when registering a credential type
-        that already exists on the internal account. Only one email OTP
-        credential and one passkey credential are supported per internal
-        account at this time.
+        Bad request. Returned with `EMAIL_OTP_CREDENTIAL_ALREADY_EXISTS`
+        when registering an email OTP credential while one already exists, or
+        `PASSKEY_CREDENTIAL_ALREADY_EXISTS` when registering a passkey whose
+        WebAuthn credentialId is already attached to the internal account.
       content:
         application/json:
           schema: