---
title: "Begin passkey enrolment (browser-only, Stage 6E)"
method: POST
path: "/api/envelopes/{envelope_id}/webauthn/register/options"
---

# Begin passkey enrolment (browser-only, Stage 6E)

`POST /api/envelopes/{envelope_id}/webauthn/register/options`

## Request

- Base URL: `https://free-sign.com`
- URL: `https://free-sign.com/api/envelopes/{envelope_id}/webauthn/register/options`
- Auth: none declared. Required headers: `x-fsig-session-signature`, `x-fsig-session-nonce`, `x-fsig-session-timestamp`, `x-fsig-session-action`

BROWSER-ONLY — not an MCP/agent tool: an AI agent has no WebAuthn authenticator. Issues PublicKeyCredentialCreationOptions for navigator.credentials.create(). Offered only after the signer has completed a signature (signer.status must be 'signed' — the OTP that produced it vouches for the email; trust-on-first-use). Requires the four session-binding headers with action 'webauthn.register'.

## Path parameters

- `envelope_id` string, required

## Headers

- `x-fsig-session-signature` string, required
- `x-fsig-session-nonce` string, required
- `x-fsig-session-timestamp` string, date-time, required
- `x-fsig-session-action` 'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate', required

## Request body

- object
  - `signer_email` string, email, required

## Response `200`

challenge_id + PublicKeyCredentialCreationOptions.

## Other responses

- `409`: signer_not_signed — enrolment is offered only post-signature.

---

[API](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api.md) · [All operations](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/llms.txt) · [OpenAPI document](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/revisions/5d8e9854ab85?raw)