---
title: "Start passkey registration"
method: POST
path: "/user/passkey/register/start"
tags: ["Enrollment"]
---

# Start passkey registration

`POST /user/passkey/register/start`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/user/passkey/register/start`
- Auth: API key in header `api-key` and API key in header `Authorization`

Returns the WebAuthn `PublicKeyCredentialCreationOptions` that the browser passes to `navigator.credentials.create()`, plus the application's `allowedOrigins` and `relyingPartyId`. Requires `'passkey'` to be present in the application's `allowedScaMethods`. A subject may hold up to two passkeys; a third registration is rejected with `100004`. — Requires an active SCA session granted within the last 15 minutes, else `30070` (`SCA_REQUIRED`) with `reason` `NO_SESSION` or `EXPIRED`, exactly as the SCA-gated reads report it; run `/user/login/start` + `/user/login/complete` and retry inside the window. An open 2FA reset for this factor whose `/complete` call has already removed the old factor authorizes the call as well, and users without an SCA-gated (EUR/USDC) account yet are exempt.

## Request body

- object
  - `userId` string, required
  - `displayName` string: Optional label for this credential ("iPhone", "Work laptop"). Returned as `displayName` by the list endpoint so the user can tell their passkeys apart.

## Response `200`

WebAuthn registration options.

- object
  - `options` object, required: Standard WebAuthn `PublicKeyCredentialCreationOptions`. Base64url-encoded binary fields are passed through to the browser without modification.
    - `rp` object
      - `id` string
      - `name` string
    - `user` object
      - `id` string
      - `name` string
      - `displayName` string
    - `challenge` string
    - `pubKeyCredParams` object[]
      - `type` string
      - `alg` integer
    - `timeout` integer
    - `excludeCredentials` object[]
      - `type` string
      - `id` string
    - `attestation` string
    - `authenticatorSelection` object
      - `userVerification` string
      - `residentKey` string
      - `requireResidentKey` boolean
      - `authenticatorAttachment` string
  - `allowedOrigins` string[], required
  - `relyingPartyId` string, required

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)