---
title: "Register local owner account"
method: POST
path: "/auth/register"
---

# Register local owner account

`POST /auth/register`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/auth/register`
- Auth: none declared

Admits only normalized permanent email addresses with a usable mail domain before creating an identity. Known permanent providers skip DNS; custom domains need MX or the RFC 5321 implicit A/AAAA route. Creates a PostgreSQL-clocked 35-day browser session and returns the authenticated identity. Browser session state is established by Set-Cookie, not a JSON bearer token.

## Headers

- `idempotency-key` string

## Request body

- AuthCredentialsRequest
  - `email` string, required
  - `password` string, required
  - `authChallenge` string: ADR 0088: base64 JSON {algorithm, challenge, number, salt, signature} solving a challenge this client received for this action; valid once within five minutes. Accepted in the JSON body of every step-up route.

## Response `201`

Registered

- AuthResponse
  - `user` AuthUser, required
    - `id` string, required
    - `email` string, required
    - `status` string, nullable
    - `deleteRequestedAt` string, date-time, nullable
    - `deletionState` 'billing_pending' | 'cleanup_pending' | 'null', nullable
    - `emailVerifiedAt` string, date-time, nullable
    - `emailVerified` boolean, required
    - `authAccessState` 'verified' | 'email_verification_required', required
    - `avatarUrl` string, nullable, required: Profile picture of the most recently used linked Google or GitHub sign-in that has one.
    - `createdAt` string, date-time, required
  - `authAccessState` 'verified' | 'email_verification_required', required
  - `emailVerification` object, required
    - `required` boolean, required
    - `verified` boolean, required
    - `sent` boolean, required
  - `capabilities` SessionCapabilities, required
    - `operator` boolean, required
    - `ownerOperator` boolean, required
  - `clientIp` string, nullable, required

## Other responses

- `400`: Malformed, temporary or unroutable email, or a password outside the policy (16 to 64 characters after NFKC normalization)
- `409`: Signup admission changed across the UTC window; explicit retry required (auth-signup-admission-changed)
- `429`: Auth step-up (ADR 0088): past the per-client signup threshold a password signup must carry a solved challenge (auth-challenge-required); retain idempotency-key and resubmit the same body with authChallenge. Past the signup ceiling it is refused (rate-limit-exceeded, scope auth.step_up, with a Retry-After header); retained per-email delivery limits apply separately
- `503`: Password hashing capacity is busy, for everyone or for this client address (Retry-After: 2), or email-domain DNS verification is temporarily unavailable, or the client address could not be proven: in hosted mode password signup is accepted only through the Web (ADR 0086); retry without losing entered input

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)