---
title: "Register"
method: POST
path: "/users/me/passkeys"
tags: ["Users"]
---

# Register

`POST /users/me/passkeys`

Registers a passkey for the authenticated user from the attestation a browser produced for a `registration` challenge. Mint that challenge first with `POST /users/me/passkeys/challenge`; it is single-use and expires 5 minutes after it is issued. Requires a user session.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `attestation_object` string, required — The `attestationObject` from the WebAuthn attestation response, base64url-encoded.
  - `client_data_json` string, required — The `clientDataJSON` from the WebAuthn attestation response, base64url-encoded.
  - `credential_id` string, required — The WebAuthn credential ID the authenticator returned, base64url-encoded.
  - `nickname` string, required — A name for this passkey, usually the device it lives on. 255 characters or fewer.

## Response `201`

passkey registered

- Passkey
  - `created_at` string, required — When the user registered this passkey, as an ISO 8601 timestamp.
  - `credential_id` string, required — The WebAuthn credential ID as a base64url string. Pass it in `allowCredentials` when you run a ceremony against this specific passkey.
  - `id` string, required — Passkey ID, prefixed `wcred_`. Use it to delete the passkey.
  - `last_used_at` string, nullable, required — When this passkey last completed a WebAuthn ceremony, as an ISO 8601 timestamp, or `null` if it never has.
  - `nickname` string, required — The name the user gave this passkey, usually the device it lives on.

## Other responses

- `400` — Invalid Parameters
- `401` — Unauthorized
- `403` — Forbidden
- `409` — Conflict

## Changes

- **2026-08-12** `ae20b30817de` — 1 info
  - added the non-success response with the status `409`
- **2026-08-07** `f1020c3ecda4` — 3 info
  - added the optional property `error/code` to the response with the `400` status
  - added the optional property `error/code` to the response with the `401` status
  - added the optional property `error/code` to the response with the `403` status
- **2026-07-31** `099fdc3be422` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/whop/apis/whop-api/changes/users/me/passkeys/post.md)

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/1b5d50d09479/schema)