---
title: "Create Authenticator"
method: POST
path: "/accounts/{account_id}/authenticators"
tags: ["Accounts: General"]
---

# Create Authenticator

`POST /accounts/{account_id}/authenticators`

## Path parameters

- `account_id` string, required

## Headers

- `LMG-Data-Privacy-Access-Principal` string, required
- `LMG-Data-Privacy-Access-Justification` string, required

## Request body

- CreateAuthenticatorRequest
  - `name` string, required — Name for the authenticator being registered. When binding to a specific device, it may be a good idea to use the device's model name, like `iPhone14,1`. This will help when the user has more than one authenticator registered for an account. **NOTE:** At the moment, there is no way to register a second authenticator, but this feature will be added in the future.
  - `public_key` string, required — Base64-url encoded form of the public key. See our guide on strong customer authentication for more details on the formats supported.
  - `client_credential_id` string, required — Client side credential identifier of when the key pair was generated. This identifier will be used to indicate the authenticator that created a signature.
  - `recovery_code` string — When resetting the authenticator, use this property to provide the recovery code from lemon.markets. The format is a six-digit string like `"123456"`.
  - `verification` VerificationRequest — An object representing proof of ownership of the private key associated with the public key being registered.
    - `nonce` string, required — The base64-url encoded form of random data used to create `signature`.
    - `signature` string, required — The base64-url encoded DER form of the signature for `nonce` using the private key for the public key that's being registered as an authenticator.

## Response `201`

Successful Response

- AuthenticatorResponse
  - `id` string, required — An authenticator identifier.
  - `created_at` string, date-time, required — A timestamp representing the point in time when the authenticator was registered.
  - `public_key` string, required — The base64-url encoded form of the authenticator's public key. See the guide on strong customer authentication for more information about the format.
  - `client_credential_id` string, required — A client-side (read: on-device) identifier for the public key of the authenticator. Use this identifier to indicate the private key used to create a signature in the two-step verification process or to match the authenticator in a list of authenticated devices. **NOTE:** All authenticators associated with a single account must have different values in `client_credential_id`.
  - `name` string, required

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `422` — Unprocessable Entity
- `5XX` — Server Error

---

[API](https://skmtc.net/lemon/apis/lemon-markets-brokerage-api.md) · [All operations](https://skmtc.net/lemon/apis/lemon-markets-brokerage-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lemon/lemon-markets-brokerage-api/revisions/3c8cfd3a96c9/schema)