---
title: "Get WebAuthn registration options"
method: POST
path: "/users/@me/mfa/webauthn/credentials/registration-options"
tags: ["Users"]
---

# Get WebAuthn registration options

`POST /users/@me/mfa/webauthn/credentials/registration-options`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/mfa/webauthn/credentials/registration-options`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/fluxer/apis/fluxer-api/docs/users/@me/mfa/webauthn/credentials/registration-options/post.ts> (a function with typed inputs; its response is checked against the schema)

Generate challenge and options to register a new WebAuthn credential. Requires sudo mode verification.

## Query parameters

- `rp_id` string, nullable: Relying party ID to use instead of the one picked from the Origin header. Only the instance relying party and the migration relying party are honoured, and only on the official instance. Any other value is ignored

## Request body

- SudoVerificationSchema
  - `password` string
  - `mfa_method` 'totp' | 'webauthn' | 'email_code': MFA method to use for verification
  - `mfa_code` string: MFA verification code from an authenticator app
  - `email_code_ticket` string: Ticket from POST /users/@me/sudo/email-code, sent with mfa_method email_code
  - `email_code` string: The 6-digit code from the email, sent with mfa_method email_code
  - `webauthn_response` WebAuthnAuthenticationResponse
    - `id` string, required
    - `rawId` string, required
    - `type` 'public-key', required
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `clientExtensionResults` object, required
      - `appid` boolean
      - `credProps` object
        - `rk` boolean
      - `hmacCreateSecret` boolean
    - `response` object, required
      - `clientDataJSON` string, required
      - `authenticatorData` string, required
      - `signature` string, required
      - `userHandle` string
  - `webauthn_challenge` string: WebAuthn challenge string

## Response `200`

Success

- WebAuthnChallengeResponse
  - `challenge` string, required: The WebAuthn challenge

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 66 revisions in range; 2 not diffed.

- **2026-11-04** `fad4dd738895`: 1 info
  - added the new optional `query` request parameter `rp_id`
- **2026-10-24** `2ecd716d4472`: 3 info
  - added the new optional request property `email_code`
  - added the new optional request property `email_code_ticket`
  - added the new `email_code` enum value to the request property `mfa_method`
- **2026-09-06** `a52a2cf49d9b`: 32 warning
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `400`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `401`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `403`
  - added the new `IP_BAN_DECLINED` enum value to the `code` response property for the response status `500`
  - …28 more
  - …this revision’s changelog is incomplete
- **2026-09-05** `4dbb738a3e22`: 4 info
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `400`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `401`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `403`
  - removed the `NSFW_EMOJI_STICKER_BLOCKED` enum value from the `code` response property for the response status `500`
- …earlier changes not shown

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/mfa/webauthn/credentials/registration-options/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/c56605b6a92d?raw)