---
title: "Registration Options"
method: POST
path: "/v1/auth/webauthn/register/options"
tags: ["auth"]
---

# Registration Options

`POST /v1/auth/webauthn/register/options`

Start registering a passkey for the signed-in identity.

A POST rather than a GET even though it reads like one: it issues a
server-side challenge and writes it, so it is not safe to repeat, cache, or
prefetch.

## Response `200`

Successful Response

- CeremonyOptions — The `PublicKeyCredentialCreationOptions`/`RequestOptions` a browser needs. Passed through as an opaque object rather than modeled field by field. The shape is the W3C's, the browser is the only consumer, and it is what ``navigator.credentials`` is handed verbatim after the two base64url fields are decoded. Restating it here would produce a second, slightly wrong copy of a spec this deployment does not own, and every field the library adds later would have to be added again to keep the client from dropping it.

## Changes

- **2026-08-24** `bd0edfaa8297` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/auth/webauthn/register/options/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/6240738fd489/schema)