# Registration Options

Start registering a passkey: the options the browser makes it with.

## Overview

- **No body** for Aurea's own relying party, exactly as before. **`{ "rpId": "…" }`** for your tenant's own passkey address [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md): its RP ID, as [Your Passkey Address](https://docs.aureahub.com/docs/passkey-address.md) answers it ([Your Own Passkey Address](https://docs.aureahub.com/docs/guide-passkeys.md)). Any other `rpId`: `400` `PASSKEY_RP_NOT_ALLOWED`.
- `200` with `publicKey` — the options for `navigator.credentials.create()` in WebAuthn's JSON form (`PublicKeyCredential.parseCreationOptionsFromJSON()`, or decode `challenge`, `user.id` and each `excludeCredentials[].id` from base64url) —, `ceremonyId`, which the registration names, and `expiresAt`: the options are used once, within 5 minutes. `Cache-Control: no-store`.
- The options ask for user verification (`required`), no attestation (`none`), ES256 (`-7`) or RS256 (`-257`), a discoverable passkey (`residentKey` `preferred`); `rp` is the relying party asked for — Aurea's, or your RP ID with your tenant's name —; `excludeCredentials` lists your active passkeys of that relying party.
- `stepUpAction`: `null` for your first passkey; `passkey.register` when you have one already, on either relying party — the new one is then confirmed with a step-up of yours ([Register a Passkey](https://docs.aureahub.com/docs/guide-passkeys.md)).
- Then [Register a Passkey](https://docs.aureahub.com/docs/passkey-register.md) with the browser's answer, made on one of that relying party's web addresses.
- 20 requests per minute per client IP.

## Endpoint

### `POST /v1/auth/passkeys/registration/options`

Authentication: bearer token required.

Starts registering a passkey: the WebAuthn creation options and the ceremony's id.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `rpId` | string | no | Optional; send no body for Aurea's own relying party. Your tenant's passkey address (`rpId` of Your Passkey Address), for your own apps' passkeys |

**Responses**

`200` OK

```json
{
  "ceremonyId": "b7d1e4a2-6c3f-4a89-9e05-2f8c1d7b3a64",
  "expiresAt": "2026-10-14T09:05:00.000Z",
  "stepUpAction": null,
  "publicKey": {
    "challenge": "VffaNTQszsm1eCkqBql2tTlUhTM_rutyKldn2vJvZro",
    "rp": { "name": "…", "id": "…" },
    "user": {
      "id": "ahyePyt9T1COSgxdO59-Eg",
      "name": "marco.cfo",
      "displayName": "marco.cfo"
    },
    "pubKeyCredParams": [
      { "alg": -7, "type": "public-key" },
      { "alg": -257, "type": "public-key" }
    ],
    "timeout": 300000,
    "attestation": "none",
    "excludeCredentials": [],
    "authenticatorSelection": {
      "residentKey": "preferred",
      "userVerification": "required",
      "requireResidentKey": false
    },
    "extensions": { "credProps": true },
    "hints": []
  }
}
```

`400` Not your RP ID

```json
{
  "statusCode": 400,
  "error": "BadRequestError",
  "message": "rpId is neither the platform's relying party nor your tenant's own passkey address",
  "details": { "code": "PASSKEY_RP_NOT_ALLOWED" }
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/auth/passkeys/registration/options \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

# For your tenant's own passkey address
curl -X POST https://api.aureahub.com/v1/auth/passkeys/registration/options \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "rpId": "example.com" }'
```

---

Web version: https://docs.aureahub.com/#passkey-registration-options