---
title: "Register App Attest key"
method: POST
path: "/users/@me/app-attest/keys"
tags: ["Users"]
---

# Register App Attest key

`POST /users/@me/app-attest/keys`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/app-attest/keys`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/fluxer/apis/fluxer-api/docs/users/@me/app-attest/keys/post.ts> (a function with typed inputs; its response is checked against the schema)

Registers an App Attest key for the current user. The attestation must be made with clientDataHash set to the SHA-256 of the UTF-8 challenge string from a challenge with purpose attest. The server keeps the key id, public key, environment, App ID and counter for at most one hour, or until the next age range submit, and does not keep the attestation itself. Registering the same key again for the same user succeeds and changes nothing. Returns APP_ATTEST_NOT_AVAILABLE with status 404 when this instance does not accept App Attest. Returns FEATURE_NOT_AVAILABLE_SELF_HOSTED with status 403 on a self-hosted instance, and AGE_RANGE_NOT_NEEDED with status 403 when the request does not come from a region where a date of birth typed in is not enough for mature content.

## Request body

- AppAttestKeyRegisterRequest
  - `key_id` string, required: App Attest key identifier from DCAppAttestService, 32 bytes as standard base64
  - `attestation` string, required: Attestation object from DCAppAttestService.attestKey as standard base64
  - `challenge` string, required: Challenge from the challenge endpoint, 32 bytes as unpadded base64url

## Response `204`

No Content

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `404`: Not Found - The requested resource was not found
- `409`: Conflict - The request conflicts with the current state of the resource
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 64 revisions in range; 2 not diffed.

- **2026-11-06** `d3bfc81d0955`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/app-attest/keys/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/2092bc8b2edf?raw)