---
title: "Verify Webauthn sign-up"
method: POST
path: "/signup/webauthn/verify"
tags: ["authentication", "verification"]
---

# Verify Webauthn sign-up

`POST /signup/webauthn/verify`

Complete the Webauthn sign-up process by verifying the response from the user's device. Returns a session if validation is successful.

## Request body

- SignUpWebauthnVerifyRequest
  - `credential` CredentialCreationResponse, required
    - `id` string, required — The credential's identifier
    - `type` string, required — The credential type represented by this object
    - `rawId` string, byte, required — Base64url-encoded binary data
    - `clientExtensionResults` AuthenticationExtensionsClientOutputs — Map of extension outputs from the client
      - `appid` boolean — Application identifier extension output
      - `credProps` CredentialPropertiesOutput — Credential properties extension output
        - `rk` boolean — Indicates if the credential is a resident key
      - `hmacCreateSecret` boolean — HMAC secret extension output
    - `authenticatorAttachment` string — The authenticator attachment
    - `response` AuthenticatorAttestationResponse, required
      - `clientDataJSON` string, byte, required — Base64url-encoded binary data
      - `transports` string[] — The authenticator transports
      - `authenticatorData` string, byte — Base64url-encoded binary data
      - `publicKey` string, byte — Base64url-encoded binary data
      - `publicKeyAlgorithm` integer — The public key algorithm identifier
      - `attestationObject` string, byte, required — Base64url-encoded binary data
  - `options` SignUpOptions
    - `allowedRoles` string[]
    - `defaultRole` string
    - `displayName` string
    - `locale` string — A two or three characters locale
    - `metadata` object
    - `redirectTo` string, uri
  - `nickname` string — Nickname for the security key
  - `codeChallenge` string — PKCE code challenge (S256). When provided and email verification is required, the verification redirect will contain an authorization code instead of a refresh token.

## Response `200`

Sign up successful

- SessionPayload — Container for session information
  - `session` Session — User authentication session containing tokens and user information
    - `accessToken` string, required — JWT token for authenticating API requests
    - `accessTokenExpiresIn` integer, required — Expiration time of the access token in seconds
    - `refreshTokenId` string, required — Identifier for the refresh token
    - `refreshToken` string, required — Token used to refresh the access token
    - `user` User — User profile and account information
      - `avatarUrl` string, required — URL to the user's profile picture
      - `createdAt` string, date-time, required — Timestamp when the user account was created
      - `defaultRole` string, required — Default authorization role for the user
      - `displayName` string, required — User's display name
      - `email` string, email — User's email address
      - `emailVerified` boolean, required — Whether the user's email has been verified
      - `id` string, required — Unique identifier for the user
      - `isAnonymous` boolean, required — Whether this is an anonymous user account
      - `locale` string, required — User's preferred locale (language code)
      - `metadata` object, required — Custom metadata associated with the user
      - `phoneNumber` string — User's phone number
      - `phoneNumberVerified` boolean, required — Whether the user's phone number has been verified
      - `roles` string[], required — List of roles assigned to the user
      - `activeMfaType` string, nullable — Active MFA type for the user

## Other responses

- `default` — An error occurred while processing the request

---

[API](https://skmtc.net/nhost/apis/nhost-authentication-api.md) · [All operations](https://skmtc.net/nhost/apis/nhost-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nhost/nhost-authentication-api/versions/a5c0d88b55c4/schema)