> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Begin passkey registration

> Returns challengeId and WebAuthn creation options for a discoverable credential with user verification. At most twenty passkeys are allowed.

A signed-in human session with recent authentication is required. Complete password/passkey reauthentication when requested.

Returns challengeId and WebAuthn creation options for a discoverable credential with user verification. At most twenty passkeys are allowed.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json POST /api/auth/passkeys/register/options
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /api/auth/passkeys/register/options:
    post:
      tags:
        - Passkeys and recovery
      summary: Begin passkey registration
      description: >-
        Returns challengeId and WebAuthn creation options for a discoverable
        credential with user verification. At most twenty passkeys are allowed.


        A signed-in human session with recent authentication is required.
        Complete password/passkey reauthentication when requested.
      operationId: post_api_auth_passkeys_register_options
      parameters:
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Posted UI origin. Required for browser
            mutations carrying session cookies.
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  challengeId:
                    type: string
                  options:
                    type: object
                    properties:
                      challenge:
                        type: string
                      rp:
                        type: object
                        properties:
                          name:
                            type: string
                          id:
                            type: string
                        additionalProperties: true
                      user:
                        type: object
                        properties:
                          id:
                            type: string
                          name:
                            type: string
                          displayName:
                            type: string
                        additionalProperties: true
                      pubKeyCredParams:
                        type: array
                        items:
                          type: object
                          properties:
                            alg:
                              type: integer
                            type:
                              type: string
                          additionalProperties: true
                      timeout:
                        type: integer
                      attestation:
                        type: string
                      excludeCredentials:
                        type: array
                        items: {}
                      authenticatorSelection:
                        type: object
                        properties:
                          residentKey:
                            type: string
                          requireResidentKey:
                            type: boolean
                          userVerification:
                            type: string
                        additionalProperties: true
                    additionalProperties: true
                additionalProperties: true
              example:
                challengeId: example-challenge-token
                options:
                  challenge: example-browser-challenge
                  rp:
                    name: Posted
                    id: posted.example.test
                  user:
                    id: ZXhhbXBsZS11c2VyLWlk
                    name: alex@example.test
                    displayName: Alex Morgan
                  pubKeyCredParams:
                    - alg: -7
                      type: public-key
                  timeout: 60000
                  attestation: none
                  excludeCredentials: []
                  authenticatorSelection:
                    residentKey: required
                    requireResidentKey: true
                    userVerification: required
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: posted_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.