# Start passkey registration

> Source: https://truto.one/docs/api-reference/admin/passkeys/registration-options/

`POST /auth/passkey/registration/options`

Resource: **Passkeys**

## Request body

- **`totp_code`** _(string)_
  Current code from the authenticator app. Required when the account has TOTP enabled; the password is not accepted in its place.
- **`password`** _(string)_
  Account password. Required when the account has one and no TOTP.

## Response body

- **`rp`** _(object)_
  Relying party. `id` is the environment's `APP_URL` host, so a passkey registered on one environment is never offered on another.
  - **`id`** _(string)_
  - **`name`** _(string)_
- **`user`** _(object)_
  User handle the authenticator groups credentials under. `id` is the base64url-encoded Truto user id.
  - **`id`** _(string)_
  - **`name`** _(string)_
  - **`displayName`** _(string)_
- **`challenge`** _(string)_
  base64url challenge. Single-use, stored server-side for 5 minutes.
- **`pubKeyCredParams`** _(array<object>)_
  Offered algorithms — Ed25519 (-8), ES256 (-7), RS256 (-257).
  - **`alg`** _(number)_
  - **`type`** _(string)_
- **`timeout`** _(number)_
  Browser-side ceremony timeout in milliseconds.
- **`attestation`** _(string)_
  v1 asks for no attestation.
  Allowed: `none`
- **`excludeCredentials`** _(array<object>)_
  The user's existing credentials, so an authenticator they already enrolled refuses to register a duplicate.
  - **`id`** _(string)_
  - **`type`** _(string)_
  - **`transports`** _(array<string>)_
- **`authenticatorSelection`** _(object)_
  `residentKey: required` because sign-in is usernameless, and `userVerification: required` so every assertion carries a second factor — which is what lets a passkey login satisfy `mfa_required`.
  - **`residentKey`** _(string)_
  - **`requireResidentKey`** _(boolean)_
  - **`userVerification`** _(string)_
- **`extensions`** _(object)_
  Client extensions the library asks for. `credProps` lets the browser report back whether the credential really was created as discoverable.
  - **`credProps`** _(boolean)_
- **`hints`** _(array<string>)_
  Always empty — v1 gives the browser no authenticator hints.

## Code examples

### curl

```bash
curl -X POST 'https://api.truto.one/auth/passkey/registration/options' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json' \
  -d '{
  "totp_code": "your_totp_code",
  "password": "your_password"
}'
```

### JavaScript

```javascript
const body = {
  "totp_code": "your_totp_code",
  "password": "your_password"
};

const response = await fetch('https://api.truto.one/auth/passkey/registration/options', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

url = "https://api.truto.one/auth/passkey/registration/options"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
}
payload = {
    "totp_code": "your_totp_code",
    "password": "your_password"
}

response = requests.post(url, headers=headers, params=params, json=payload)
print(response.json())
```