Stytch – The most powerful identity platform built for developers

Start WebAuthn registration

POST

https://test.stytch.com/v1/webauthn/register/start

Initiate the process of creating a new Passkey or WebAuthn registration.

To optimize for Passkeys, set the return_passkey_credential_options field to true.

After calling this endpoint, the browser will need to call navigator.credentials.create() with the data from public_key_credential_creation_options passed to the navigator.credentials.create() request via the public key argument.

When using built-in browser methods like navigator.credentials.create(), set the use_base64_url_encoding option to true.

See our WebAuthn setup guide for additional usage instructions and example code.

Body parameters

return_passkey_credential_options boolean

If true, the public_key_credential_creation_options returned will be optimized for Passkeys with residentKey set to "required" and userVerification set to "preferred".

user_id* string

The user_id of an active user the Passkey or WebAuthn registration should be tied to. You may use an external_id here if one is set for the user.

domain* string

The domain for Passkeys or WebAuthn. Defaults to window.location.hostname.

use_base64_url_encoding boolean

If true, values in the public_key_credential_creation_options will be base64 URL encoded. Set this option to true when using built-in browser methods like navigator.credentials.create and navigator.credentials.get.

user_agent string

The user agent of the client.

authenticator_type string

The requested authenticator type of the Passkey or WebAuthn device. The two valid values are platform and cross-platform. If no value passed, we assume both values are allowed.

Response fields

status_code int

The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

request_id string

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.

user_id string

The unique ID of the affected User.

public_key_credential_creation_options string

Options used for Passkey or WebAuthn registration.

const stytch = require('stytch');

const client = new stytch.Client({
  project_id: 'PROJECT_ID',
  secret: 'SECRET',
});

const params = {
  user_id: "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
  domain: "example.com",
};

client.webauthn.registerStart(params)
  .then(resp => { console.log(resp) })
  .catch(err => { console.log(err) });

RESPONSE 200

{
  "status_code": 200,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
  "public_key_credential_request_options": "{\"allowCredentials\":[{\"id\":\"AUnfDtA+myCDdumkKnVp2Sk0MIWCPXQVL2mG3h+xQBvLEF+MmNqvj2ZwNIY8id5UHz7ogZKmGgc0mM9yYVhdJNU1n6nIwPBGUuZpr3N18trqXMKxejYYKwCO4BmSHA==\",\"type\":\"public-key\"},],\"challenge\":\"hYZtLNT9SIgZqPnKfbnQX3nCJ7NavTT_S6oC9XREYv0F\",\"rpId\":\"example.com\",\"timeout\":300000,\"userVerification\":\"discouraged\"}"
}

RESPONSE 400

{
  "status_code": 400,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "invalid_user_id",
  "error_message": "user_id format is invalid.",
  "error_url": "https://stytch.com/docs/api/errors/400"
}

RESPONSE 404

{
  "status_code": 404,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "user_not_found",
  "error_message": "User could not be found.",
  "error_url": "https://stytch.com/docs/api/errors/404"
}

RESPONSE 429

{
  "status_code": 429,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "too_many_requests",
  "error_message": "Too many requests have been made.",
  "error_url": "https://stytch.com/docs/api/errors/429"
}

RESPONSE 500

{
  "status_code": 500,
  "request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
  "error_type": "internal_server_error",
  "error_message": "Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.",
  "error_url": "https://stytch.com/docs/api/errors/500"
}

Common Error Types

invalid_domain

Delete

Via email

Embeddable

Start

Reset options

Via SMS

Via Whatsapp

Via email

Register

Authenticate

Token

M2M Client

Rotate secret

Tokens

Configuration

Methods

Consent Management

Application Management

Rotate secret

Start WebAuthn registration

Body parameters

Response fields

Common Error Types