---
title: "Start passkey MFA enrollment"
method: POST
path: "/v1/users/{user_id}/mfa/passkey/enrollment/init"
tags: ["Users MFA"]
---

# Start passkey MFA enrollment

`POST /v1/users/{user_id}/mfa/passkey/enrollment/init`

## Request

- Base URL: `https://api.privy.io`
- URL: `https://api.privy.io/v1/users/{user_id}/mfa/passkey/enrollment/init`
- Auth: HTTP basic

Returns WebAuthn registration options for a new MFA passkey.

## Path parameters

- `user_id` string, required

## Headers

- `privy-app-id` string, required: ID of your Privy app.
- `privy-user-token` string, required: Access token or custom authentication JWT for the user the request acts on.
- `privy-mfa-token` string: MFA token from a completed MFA verification, required on MFA-protected requests for users with MFA enrolled.

## Request body

- PasskeyMfaInitRequestBody: Starts a passkey MFA ceremony for the specified relying party origin.
  - `relying_party` string, uri, required: Origin where the authenticator runs, such as https://app.example.com.

## Response `200`

WebAuthn registration options.

- PasskeyMfaEnrollmentInitResponse: WebAuthn registration options for the started passkey MFA enrollment.
  - `options` MfaPasskeyAuthenticatorEnrollmentOptions, required: WebAuthn registration options as defined by the Web Authentication specification.
    - `rp` MfaPasskeyRelyingParty, required: Relying party information for a WebAuthn ceremony.
      - `name` string, required
      - `id` string
    - `user` MfaPasskeyUser, required: User entity for a WebAuthn registration ceremony.
      - `id` string, required
      - `name` string, required
      - `display_name` string, required
    - `challenge` string, required
    - `pub_key_cred_params` MfaPasskeyPubKeyCredParam[], required
      - `alg` number, required
      - `type` 'public-key', required
    - `timeout` number
    - `exclude_credentials` MfaPasskeyCredentialDescriptor[]
      - `id` string, required
      - `type` string, required
      - `transports` string[]
    - `authenticator_selection` MfaPasskeyAuthenticatorSelection: Authenticator selection criteria for a WebAuthn registration ceremony.
      - `authenticator_attachment` string
      - `require_resident_key` boolean
      - `resident_key` string
      - `user_verification` string
    - `attestation` string
    - `extensions` MfaPasskeyEnrollmentExtensions: Extensions for a WebAuthn registration ceremony.
      - `app_id` string
      - `cred_props` MfaPasskeyCredPropsResult: The result of the WebAuthn credProps extension.
        - `rk` boolean
      - `hmac_create_secret` boolean

## Changes

- **2026-10-28** `6a80d4be53a8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/privy-io/apis/privy-api/changes/v1/users/:user_id/mfa/passkey/enrollment/init/post.md)

---

[API](https://skmtc.dev/privy-io/apis/privy-api.md) - [All operations](https://skmtc.dev/privy-io/apis/privy-api/llms.txt) - [OpenAPI document](https://skmtc.dev/privy-io/apis/privy-api/revisions/6a80d4be53a8?raw)