---
title: "Finish passkey enrolment (browser-only, Stage 6E)"
method: POST
path: "/api/envelopes/{envelope_id}/webauthn/register/verify"
---

# Finish passkey enrolment (browser-only, Stage 6E)

`POST /api/envelopes/{envelope_id}/webauthn/register/verify`

## Request

- Base URL: `https://free-sign.com`
- URL: `https://free-sign.com/api/envelopes/{envelope_id}/webauthn/register/verify`
- Auth: none declared. Required headers: `x-fsig-session-signature`, `x-fsig-session-nonce`, `x-fsig-session-timestamp`, `x-fsig-session-action`

BROWSER-ONLY — not an MCP/agent tool. Verifies the navigator.credentials.create() attestation (challenge / origin / rpId / UP+UV flags, attestation 'none') and stores the credential. Idempotent for re-enrolment of the same authenticator. Requires the four session-binding headers with action 'webauthn.register'.

## Path parameters

- `envelope_id` string, required

## Headers

- `x-fsig-session-signature` string, required
- `x-fsig-session-nonce` string, required
- `x-fsig-session-timestamp` string, date-time, required
- `x-fsig-session-action` 'otp.request' | 'otp.verify' | 'sign' | 'seal' | 'platform-seal' | 'finalize' | 'webauthn.register' | 'webauthn.authenticate', required

## Response `200`

{ enrolled: true } — passkey stored.

## Other responses

- `400`: webauthn_registration_failed / webauthn_challenge_* — attestation rejected.

---

[API](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api.md) · [All operations](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/llms.txt) · [OpenAPI document](https://skmtc.dev/free-sign/apis/freesign-free-e-signature-api/revisions/5d8e9854ab85?raw)