---
title: "Passkey Signup Begin"
method: POST
path: "/auth/passkey/signup/begin"
tags: ["auth"]
---

# Passkey Signup Begin

`POST /auth/passkey/signup/begin`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/auth/passkey/signup/begin`
- Auth: none declared

Starts a passkey-only signup: a new person joins an OPEN workspace with nothing but a passkey (no email, no phone). Returns WebAuthn creation options (a discoverable, user-verifying passkey whose user handle is the new person's id) and an opaque `handle` to echo to finishPasskeySignup. Requires a passing Cloudflare Turnstile `turnstile_token`. Refusals: 403 `registration_rejected` (workspace not open-join, or inactive), 403 `wrong_auth_scheme` (a Privy-backed workspace), 409 `webauthn_not_configured` (no passkey relying party for this host), 403 `passkey_signup_unavailable` (off on this instance, Turnstile not configured, or the workspace's sign-in settings disallow passkeys), 403 `turnstile_failed`, 503 `turnstile_unavailable` (retry), 429 `passkey_signup_limit_reached` (the workspace's daily passkey-signup cap), 400 `invalid_display_name`, 404 `tenant_not_found` / `tenant_code_expired`. `GET /auth/config` reports `passkey_signup` for the workspace. Invites stay email-bound: an invite-only workspace cannot be joined this way.

## Request body

- EnforcerV3InternalUsecaseAuthPasskeySignupBeginInput
  - `display_name` string: DisplayName is optional: the name the passkey is saved under and the person's name. At most 100 characters.
  - `tenant_code` string: TenantCode names the open workspace to join; empty = the instance default.
  - `turnstile_token` string: TurnstileToken is the Cloudflare Turnstile widget's response token.

## Response `200`

OK

- InternalDeliveryHttpHandlerPasskeyChallengeResponse
  - `handle` string
  - `options` object
  - `success` boolean

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `429`: Too Many Requests
- `503`: Service Unavailable

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)