Register
Registers a passkey for the authenticated user from the attestation a browser produced for a registration challenge. Mint that challenge first with POST /users/me/passkeys/challenge; it is single-use and expires 5 minutes after it is issued. Requires a user session.
Authorizations
An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.
Headers
A unique key that makes this request safe to retry. See Idempotent requests.
255"d9105228-4a08-46b1-8b91-42fed586d383"
Pins the request to a dated API version.
"2026-07-29-1"
Body
The attestationObject from the WebAuthn attestation response, base64url-encoded.
The clientDataJSON from the WebAuthn attestation response, base64url-encoded.
The WebAuthn credential ID the authenticator returned, base64url-encoded.
A name for this passkey, usually the device it lives on. 255 characters or fewer.
Response
passkey registered
When the user registered this passkey, as an ISO 8601 timestamp.
The WebAuthn credential ID as a base64url string. Pass it in allowCredentials when you run a ceremony against this specific passkey.
Passkey ID, prefixed wcred_. Use it to delete the passkey.
When this passkey last completed a WebAuthn ceremony, as an ISO 8601 timestamp, or null if it never has.
The name the user gave this passkey, usually the device it lives on.

