Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

​
Endpoint

POST /passkey/register Initiate passkey registration for a new user during sign up. The endpoint creates a passkey enrollment session, validates the supplied user profile against the database connection’s signup attributes, and returns the WebAuthn creation parameters your application passes to the platform authenticator. After the authenticator returns an attestation, you complete enrollment by exchanging the assertion at /oauth/token using the passkey grant.

​
Remarks

  • The application’s grant types must include: urn:okta:params:oauth:grant-type:webauthn.
  • The application must be a first-party application. Third-party applications are not allowed to call this endpoint.
  • The application must be OIDC conformant.
  • The request must be made against a custom domain configured for your tenant. Calls to the default Auth0 domain ({tenant}.auth0.com) are rejected.
  • user_profile must contain every identifier marked required for signup on the connection (commonly email, phone_number, or username). Additional identifiers may be optional.
  • A user is identified as already-existing through any of the configured identifiers; if any submitted identifier resolves to an existing user, the request fails with invalid_request.

​
Request Body

​
client_id
string
required
The client_id of your application.
​
client_secret
string
The client_secret of your application. Required for confidential applications using the client_secret_post token endpoint authentication method.
​
realm
string
Name of the database connection the user is signing up against. If omitted, Auth0 uses your tenant’s default database connection for the application.
​
organization
string
ID of the Auth0 Organization to which the user is signing in. Required when the application’s organization_usage is set to require.
​
user_profile
object
required
Profile attributes for the new user. Properties must match the signup attributes (required and optional) configured on the database connection. Unrecognized properties cause the request to fail with invalid_request.
​
user_metadata
object
Optional user metadata to attach to the new user. Up to 10 string fields.

​
Response

A successful response contains the WebAuthn creation parameters and an auth_session value that ties the subsequent attestation to this registration request.
​
auth_session
string
Opaque session identifier. Pass it in the token exchange request that completes the passkey registration.
​
authn_params_public_key
object
WebAuthn PublicKeyCredentialCreationOptions to invoke on the platform authenticator.
StatusDescription
200Registration challenge generated successfully.
400Invalid request. Common causes include missing required user_profile identifiers, an invalid user_profile field, an invalid user_metadata field, the user already exists, the application is not configured for passkey authentication, the request was not made against a custom domain, or the application is third-party.
401Unauthorized. Invalid client credentials.
404The Passkey APIs are not enabled for the tenant.
429Too many requests. Per-IP rate limit exceeded.