Skip to main content
POST
Register

Authorizations

Authorization
string
header
required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Idempotency-Key
string

A unique key that makes this request safe to retry. See Idempotent requests.

Maximum string length: 255
Example:

"d9105228-4a08-46b1-8b91-42fed586d383"

Api-Version-Date
string

Pins the request to a dated API version.

Example:

"2026-07-29-1"

Body

application/json
attestation_object
string
required

The attestationObject from the WebAuthn attestation response, base64url-encoded.

client_data_json
string
required

The clientDataJSON from the WebAuthn attestation response, base64url-encoded.

credential_id
string
required

The WebAuthn credential ID the authenticator returned, base64url-encoded.

nickname
string
required

A name for this passkey, usually the device it lives on. 255 characters or fewer.

Response

passkey registered

created_at
string
required

When the user registered this passkey, as an ISO 8601 timestamp.

credential_id
string
required

The WebAuthn credential ID as a base64url string. Pass it in allowCredentials when you run a ceremony against this specific passkey.

id
string
required

Passkey ID, prefixed wcred_. Use it to delete the passkey.

last_used_at
string | null
required

When this passkey last completed a WebAuthn ceremony, as an ISO 8601 timestamp, or null if it never has.

nickname
string
required

The name the user gave this passkey, usually the device it lives on.