---
title: "Create Authenticator"
method: POST
path: "/accounts/{account_id}/authenticators"
tags: ["Accounts: General"]
---

# Create Authenticator

`POST /accounts/{account_id}/authenticators`

## Request

- Base URL: `https://sandbox.api.lemon.markets/v1`
- URL: `https://sandbox.api.lemon.markets/v1/accounts/{account_id}/authenticators`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/docs/accounts/:account_id/authenticators/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `account_id` string, required

## Headers

- `LMG-Data-Privacy-Access-Principal` string, required
- `LMG-Data-Privacy-Access-Justification` string, required

## Request body

- CreateAuthenticatorRequest
  - `name` string, required: Name for the authenticator being registered. When binding to a specific device, it may be a good idea to use the device's model name, like `iPhone14,1`. This will help when the user has more than one authenticator registered for an account. **NOTE:** At the moment, there is no way to register a second authenticator, but this feature will be added in the future.
  - `public_key` string, required: Base64-url encoded form of the public key. See our guide on strong customer authentication for more details on the formats supported.
  - `client_credential_id` string, required: Client side credential identifier of when the key pair was generated. This identifier will be used to indicate the authenticator that created a signature.
  - `recovery_code` string: When resetting the authenticator, use this property to provide the recovery code from lemon.markets. The format is a six-digit string like `"123456"`.
  - `verification` VerificationRequest: An object representing proof of ownership of the private key associated with the public key being registered.
    - `nonce` string, required: The base64-url encoded form of random data used to create `signature`.
    - `signature` string, required: The base64-url encoded DER form of the signature for `nonce` using the private key for the public key that's being registered as an authenticator.

## Response `201`

Successful Response

- AuthenticatorResponse
  - `id` string, required: An authenticator identifier.
  - `created_at` string, date-time, required: A timestamp representing the point in time when the authenticator was registered.
  - `public_key` string, required: The base64-url encoded form of the authenticator's public key. See the guide on strong customer authentication for more information about the format.
  - `client_credential_id` string, required: A client-side (read: on-device) identifier for the public key of the authenticator. Use this identifier to indicate the private key used to create a signature in the two-step verification process or to match the authenticator in a list of authenticated devices. **NOTE:** All authenticators associated with a single account must have different values in `client_credential_id`.
  - `name` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found
- `422`: Unprocessable Entity
- `5XX`: Server Error

---

[API](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api.md) - [All operations](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lemon/apis/lemon-markets-brokerage-api/revisions/1f1df208c0e4?raw)