Begin WebAuthn Registration

POST /api/v1/account/2fa/webauthn/register/begin

Starts registering a passkey or a security key as a two-factor factor. The response has WebAuthn options for the browser. Pass them to navigator.credentials.create(), then call Finish WebAuthn registration within 10 minutes. Pacifica accepts passkeys only from the Pacifica app. A script or bot cannot register one. API clients should use an authenticator app. See Passkeys and security keys.

Operation Type (for Signing)

Header Field	Type	Content
`"type"`	string	`"begin_webauthn_registration"`

Request Body

Field	Type	Need	Description	Example
`”account”`	string	required	User’s wallet address	`42trU9A5…`
`“signature”`	string	required	Cryptographic signature	`5j1Vy9Uq…`
`“timestamp”`	integer	required	Current timestamp in milliseconds	`1716200000000`
`”kind”`	string	required	Factor kind: `“passkey"` `"security_key”`	`security_key`
`”label”`	string	required	Your name for the factor. 1 to 64 characters, with no control characters and no leading or trailing spaces	`YubiKey 5C`
`”expiry_window”`	integer	optional	Signature expiry in milliseconds	`30000`
`”two_factor”`	object	conditional	Proof. Required while 2FA is on. Not part of the signed payload. See Proofs

{
  "account": "42trU9A5...",
  "signature": "5j1Vy9Uq...",
  "timestamp": 1716200000000,
  "kind": "security_key",
  "label": "YubiKey 5C",
  "expiry_window": 30000,
  "two_factor": {
    "type": "totp",
    "code": "123456"
  }
}

Sign this request with the account’s own key. Agent wallets cannot sign it. The account must be a main account. If 2FA is already on, send a proof in two_factor. Any proof type works, including a recovery key. After the proof passes, you can send the same request with the same kind and label again for 5 minutes without a new proof. This helps when the user cancels the browser prompt. A "passkey" must verify the user with a PIN or biometric. A "security_key" asks the browser for a separate device, such as a USB or NFC key. The device names the new credential with a short form of your wallet address and your label.

Signing

Sign kind and label as the data object. Do not sign two_factor. For the request above, the message to sign is:

{"data":{"kind":"security_key","label":"YubiKey 5C"},"expiry_window":30000,"timestamp":1716200000000,"type":"begin_webauthn_registration"}

Response

Status 200: Registration started

{
  "success": true,
  "data": {
    "challenge_id": "45c48cce-2e2d-4fbd-8f3b-7a1c9e0d5b62",
    "options": {
      "publicKey": {
        "challenge": "x8Jf2KqLm0pR..."
      }
    }
  },
  "error": null,
  "code": null
}

The options above are shortened.

Field	Type	Description
`'challenge_id'`	string	Challenge ID (UUID). Send it to Finish WebAuthn registration within 10 minutes. It works once
`'options'`	object	WebAuthn creation options for `navigator.credentials.create()`. Binary values are base64url strings

Status 400: Invalid request parameters, label, or signature
Status 401: The proof is wrong, expired, or already used
Status 403: The account is a subaccount, or it does not exist
Status 422: The account has no room for another factor (a user can have at most 8 factors)
Status 428: 2FA is on, and the request has no two_factor
Status 429: Too many proof attempts, or more than 20 enrollments started in 10 minutes
Status 500: Internal server error
Status 503: The two-factor service is unavailable. Retry later

Code Example (Python)

import requests

payload = {
    "account": "42trU9A5...",
    "signature": "5j1Vy9Uq...",
    "timestamp": 1716200000000,
    "kind": "security_key",
    "label": "YubiKey 5C",
    "two_factor": {"type": "totp", "code": "123456"}
}

response = requests.post(
    "/api/v1/account/2fa/webauthn/register/begin",
    json=payload,
    headers={"Content-Type": "application/json"}
)

data = response.json()

​Operation Type (for Signing)

​Request Body

​Signing

​Response

​Code Example (Python)

Operation Type (for Signing)

Request Body

Signing

Response

Code Example (Python)