---
title: "Register a new tenant + owner user"
method: POST
path: "/auth/register"
tags: ["Auth"]
---

# Register a new tenant + owner user

`POST /auth/register`

## Request

- Base URL: `http://localhost:38200`
- URL: `http://localhost:38200/auth/register`
- Auth: none required

Creates a new tenant (auto-generated slug) and an owner user, sets the JWT httpOnly cookie immediately, and sends a verification email. Rate-limited to 5 requests/hour per IP.

## Request body

- object
  - `email` string, email, required
  - `password` string, required: NIST SP 800-63B Rev.4 password-only floor. Registration always creates a brand-new user (no possible confirmed MFA row yet), so the relaxed 8-char MFA-enrolled floor never applies here. Also checked against the HIBP breached-password corpus (k-anonymity; fails open on an HIBP outage).
  - `tenantName` string, required: Display name for the new tenant. Empty string falls back to a generated name.
  - `turnstileToken` string: Cloudflare Turnstile token. Required only when TURNSTILE_SECRET_KEY is configured server-side.

## Response `200`

Registered. JWT cookie set on the response.

- AuthSessionResponse
  - `user` object
    - `id` integer
    - `email` string, email
    - `role` 'owner' | 'admin' | 'member'
    - `isSuperAdmin` boolean
    - `emailVerified` boolean
    - `createdAt` string, date-time
  - `tenant` object
    - `id` integer
    - `name` string
    - `slug` string
    - `plan` string
    - `createdAt` string, date-time

## Other responses

- `400`: Request body/query failed Zod validation.
- `429`: Rate limit exceeded for this endpoint.

---

[API](https://skmtc.dev/contextq/apis/contextq-api.md) · [All operations](https://skmtc.dev/contextq/apis/contextq-api/llms.txt) · [OpenAPI document](https://skmtc.dev/contextq/apis/contextq-api/revisions/7afc44056a22?raw)