---
title: "Create a new customer account (self-service signup)."
method: POST
path: "/auth/signup"
tags: ["Auth"]
---

# Create a new customer account (self-service signup).

`POST /auth/signup`

Initiates a new customer account registration. The request must include `accepted_tos: true`
to confirm Terms of Service agreement.

On success, returns a customer object and a provisioned access key. On failure (e.g., duplicate email),
still returns HTTP 200 with an empty body to prevent email enumeration attacks.

After signup, the customer receives a verification email. Use `POST /auth/email-verify` with the
token from the email to verify the account.

## Request body

- RequestBodyAuthSignupPOST — Request body for POST /auth/signup (self-service customer registration).
  - `name` string — Display name for the customer account.
  - `detail` string — Additional details about the customer.
  - `email` string, email, required — Email address for the new customer account. Must be unique across all customers.
  - `phone_number` string — Contact phone number in E.164 format.
  - `address` string — Mailing address of the customer.
  - `webhook_method` string — HTTP method for webhook delivery. One of: POST, GET, PUT, DELETE.
  - `webhook_uri` string — URI where webhook events will be delivered.
  - `accepted_tos` boolean, required — Must be `true` to confirm acceptance of the Terms of Service. Requests with `false` or missing value are rejected with HTTP 400.

## Response `200`

Signup initiated successfully, or silently ignored if the email already exists (to prevent enumeration).
On success, the response contains the customer object and a provisioned access key.
On failure, the response body is an empty JSON object `{}`.

- CustomerManagerSignupResult — Result of a successful signup. Contains the newly created customer and a provisioned access key.
  - `customer` CustomerManagerCustomer
    - `id` string, uuid — The unique identifier of the customer.
    - `name` string — Name of the customer.
    - `detail` string — Details about the customer.
    - `email` string, email — Email address of the customer.
    - `phone_number` string — Customer's contact phone number in E.164 format.
    - `address` string — Address of the customer.
    - `webhook_method` '' | 'POST' | 'GET' | 'PUT' | 'DELETE' — The HTTP method used for webhook (e.g., POST, GET, PUT, DELETE).
    - `webhook_uri` string — URI where webhook events are delivered.
    - `billing_account_id` string, uuid — The unique identifier of the customer's default billing account. Returned from the `GET /billing_accounts/{id}` response.
    - `metadata` CustomerManagerMetadata — Configuration flags for a customer account. Controls platform behavior such as RTP packet capture for debugging audio issues. Updatable by CustomerAdmin via `PUT /customer/metadata` or by ProjectSuperAdmin via `PUT /customers/{id}/metadata`.
      - `rtp_debug` boolean — When set to `true`, RTPEngine captures RTP traffic as PCAP files for this customer's calls. Use this to debug audio quality issues (one-way audio, codec problems, jitter). Default is `false`. Enabling this increases storage usage — disable after debugging.
    - `email_verified` boolean — Whether the customer's email has been verified.
    - `status` 'initial' | 'active' | 'frozen' | 'deleted' | 'expired' — Account lifecycle status.
    - `identity_verification_status` 'none' | 'pending' | 'verified' | 'rejected' — Customer's identity verification status. Determines access to PSTN number purchases and outbound PSTN calls.
    - `tm_deletion_scheduled` string, date-time — Timestamp when account deletion was requested. Null if not scheduled.
    - `tm_create` string, date-time — Timestamp when the customer was created.
    - `tm_update` string, date-time — Timestamp when the customer was last updated.
    - `tm_delete` string, date-time — Timestamp when the customer was deleted.
  - `accesskey` CustomerManagerAccesskey
    - `id` string, uuid — The unique identifier of the access key.
    - `customer_id` string, uuid — The unique identifier of the customer. Returned from the `GET /customers` response.
    - `name` string — Name of the access key.
    - `detail` string — Additional details about the access key.
    - `token` string — The access key token. Only returned once at creation time via `POST /accesskeys`. Subsequent `GET` requests will not include this field. Store it securely immediately after creation.
    - `token_prefix` string — A short prefix of the access key token for identification purposes. Always returned in `GET` responses.
    - `tm_expire` string, date-time — Timestamp when the access key expires.
    - `tm_create` string, date-time — Timestamp when the access key was created.
    - `tm_update` string, date-time — Timestamp when the access key was last updated.
    - `tm_delete` string, date-time — Timestamp when the access key was deleted.

## Other responses

- `400` — Bad request. Possible causes: - `accepted_tos` is `false` or missing. - `email` is missing. - Request body is malformed JSON.

---

[API](https://skmtc.net/voipbin/apis/voipbin-api.md) · [All operations](https://skmtc.net/voipbin/apis/voipbin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/voipbin/voipbin-api/revisions/79e779080bcc/schema)