---
title: "Sign up with Webauthn"
method: POST
path: "/signup/webauthn"
tags: ["authentication"]
---

# Sign up with Webauthn

`POST /signup/webauthn`

Initiate a Webauthn sign-up process by sending a challenge to the user's device. The user must not have an existing account.

## Request body

- SignUpWebauthnRequest
  - `email` string, email, required — A valid email
  - `options` SignUpOptions
    - `allowedRoles` string[]
    - `defaultRole` string
    - `displayName` string
    - `locale` string — A two or three characters locale
    - `metadata` object
    - `redirectTo` string, uri

## Response `200`

Challenge sent

- PublicKeyCredentialCreationOptions
  - `rp` RelyingPartyEntity, required
    - `name` string, required — A human-palatable name for the entity
    - `id` string, required — A unique identifier for the Relying Party entity, which sets the RP ID
  - `user` UserEntity, required
    - `name` string, required — A human-palatable name for the entity
    - `displayName` string, required — A human-palatable name for the user account, intended only for display
    - `id` string, required — The user handle of the user account entity
  - `challenge` string, byte, required — Base64url-encoded binary data
  - `pubKeyCredParams` CredentialParameter[], required — The desired credential types and their respective cryptographic parameters
    - `type` 'public-key', required — The valid credential types
    - `alg` integer, required — The cryptographic algorithm identifier
  - `timeout` integer — A time, in milliseconds, that the caller is willing to wait for the call to complete
  - `excludeCredentials` PublicKeyCredentialDescriptor[] — A list of PublicKeyCredentialDescriptor objects representing public key credentials that are not acceptable to the caller
    - `type` 'public-key', required — The valid credential types
    - `id` string, byte, required — Base64url-encoded binary data
    - `transports` AuthenticatorTransport[] — The authenticator transports that can be used
  - `authenticatorSelection` AuthenticatorSelection
    - `authenticatorAttachment` 'platform' | 'cross-platform' — The authenticator attachment modality
    - `requireResidentKey` boolean — Whether the authenticator must create a client-side-resident public key credential source
    - `residentKey` 'discouraged' | 'preferred' | 'required' — The resident key requirement
    - `userVerification` 'required' | 'preferred' | 'discouraged' — A requirement for user verification for the operation
  - `hints` PublicKeyCredentialHints[] — Hints to help guide the user through the experience
  - `attestation` 'none' | 'indirect' | 'direct' | 'enterprise' — The attestation conveyance preference
  - `attestationFormats` AttestationFormat[] — The preferred attestation statement formats
  - `extensions` AuthenticationExtensions — Additional parameters requesting additional processing by the client and authenticator

## Other responses

- `default` — An error occurred while processing the request

## Changes

- **2026-06-24** `0fc5fd589dbf` — 1 warning
  - added the new `otp-too-many-attempts` enum value to the `error` response property for the response status `default`
- **2026-04-20** `b39086c84b43` — 1 warning, 1 info
  - added the new `user-already-exists` enum value to the `error` response property for the response status `default`
  - removed the `email-already-in-use` enum value from the `error` response property for the response status `default`
- **2026-01-13** `7560a2934be4` — 1 info
  - the `options/locale` request property's maxLength was increased from `2` to `3`
- **2025-11-11** `484d9f1a422a` — 1 warning
  - added the new `provider-account-already-linked` enum value to the `error` response property for the response status `default`
- **2025-10-09** `2bb5c4e40463` — 1 breaking, 1 warning, 3 info
  - the `options/locale` request property's maxLength was decreased to `2`
  - added the new `email-already-in-use` enum value to the `error` response property for the response status `default`
  - removed the `otp-too-many-attempts` enum value from the `error` response property for the response status `default`
  - removed the `provider-account-already-linked` enum value from the `error` response property for the response status `default`
  - …1 more

[Change history](https://skmtc.dev/nhost/apis/nhost-authentication-api/changes/signup/webauthn/post.md)

---

[API](https://skmtc.dev/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.dev/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/revisions/a5c0d88b55c4/schema)