> ## Documentation Index
> Fetch the complete documentation index at: https://www.mill.fyi/llms.txt
> Use this file to discover all available pages before exploring further.

# Begin passkey registration

> Returns challengeId and WebAuthn creation options for a discoverable credential with user verification. At most twenty passkeys are allowed.

A signed-in human session with recent authentication is required. Complete password/passkey reauthentication when requested.

Returns challengeId and WebAuthn creation options for a discoverable credential with user verification. At most twenty passkeys are allowed.

[Request conventions](https://www.mill.fyi/api-reference/overview.md) · [API keys](https://www.mill.fyi/api-keys.md) · [MCP connections](https://www.mill.fyi/mcp-connections.md)


## OpenAPI

````yaml api-reference/openapi.json POST /api/auth/passkeys/register/options
openapi: 3.1.0
info:
  title: Mill HTTP API
  version: 1.0.6
  description: >-
    All registered task-board, account, OAuth, MCP transport and health
    operations. MCP tool schemas come from runtime validators; account
    operations follow their server handlers. Example data is fictional.
    Generation imports routes without issuing requests or connecting to a
    database.
servers:
  - url: https://mill-api.example.com
security: []
paths:
  /api/auth/passkeys/register/options:
    post:
      tags:
        - Passkeys and recovery
      summary: Begin passkey registration
      description: >-
        Returns challengeId and WebAuthn creation options for a discoverable
        credential with user verification. At most twenty passkeys are allowed.


        A signed-in human session with recent authentication is required.
        Complete password/passkey reauthentication when requested.
      operationId: post_api_auth_passkeys_register_options
      parameters:
        - name: Origin
          in: header
          required: true
          schema:
            type: string
            format: uri
          description: >-
            The exact configured Mill UI origin. Required for browser mutations
            carrying session cookies.
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  challengeId:
                    type: string
                  options:
                    type: object
                    properties:
                      challenge:
                        type: string
                      rp:
                        type: object
                        properties:
                          name:
                            type: string
                          id:
                            type: string
                        additionalProperties: true
                      user:
                        type: object
                        properties:
                          id:
                            type: string
                          name:
                            type: string
                          displayName:
                            type: string
                        additionalProperties: true
                      pubKeyCredParams:
                        type: array
                        items:
                          type: object
                          properties:
                            alg:
                              type: integer
                            type:
                              type: string
                          additionalProperties: true
                      timeout:
                        type: integer
                      attestation:
                        type: string
                      excludeCredentials:
                        type: array
                        items: {}
                      authenticatorSelection:
                        type: object
                        properties:
                          residentKey:
                            type: string
                          requireResidentKey:
                            type: boolean
                          userVerification:
                            type: string
                        additionalProperties: true
                    additionalProperties: true
                additionalProperties: true
                description: >-
                  Illustrative response shape. Fields can be absent in alternate
                  successful flows; see the operation description and example.
              example:
                challengeId: example-challenge-token
                options:
                  challenge: example-browser-challenge
                  rp:
                    name: Mill
                    id: mill.example.test
                  user:
                    id: ZXhhbXBsZS11c2VyLWlk
                    name: alex@example.test
                    displayName: Alex Morgan
                  pubKeyCredParams:
                    - alg: -7
                      type: public-key
                  timeout: 60000
                  attestation: none
                  excludeCredentials: []
                  authenticatorSelection:
                    residentKey: required
                    requireResidentKey: true
                    userVerification: required
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - sessionCookie: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: mill_session
      description: >-
        Signed-in human browser session; mutation requests also need the exact
        UI Origin

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.