Skip to main content
POST

Authorizations

​
Authorization
string
header
required

Bearer and DPoP tokens are supported depending on the API configuration

Headers

​
x-correlation-id
string

A client-provided unique identifier for a single operation, used to correlate the request across Auth0 systems. The value is surfaced under references.correlation_id in tenant logs and echoed back on the response's x-correlation-id header. Invalid or oversized values are silently dropped and replaced by a generated UUID v4. Avoid including personally identifiable information (PII).

​
traceparent
string

A W3C Trace Context header used to correlate the request across distributed traces. When supplied, the inbound trace is continued and a fresh child span is echoed back on the response's traceparent header; the trace ID is also surfaced under references.trace_id in tenant logs. Malformed values are ignored.

​
x-request-language
string

Specifies the language used for localized content generated while handling the request (such as OTP email or SMS messages), using one of the tenant's configured Supported Languages.

Body

application/json

Request content for creating an authentication method

​
type
string
default:passkey
required

Authentication method type (factor)

Allowed value: "passkey"
​
connection
string

Name of the database connection

Required string length: 1 - 128
Pattern: ^[a-zA-Z0-9-]+$
​
identity_user_id
string

Identity provider user ID

Required string length: 1 - 255
Pattern: ^\S+$
​
use_exclude_credentials
boolean

When enabled, Auth0 includes the user's existing credentials in the excludeCredentials field during passkey enrollment. This prevents users from accidentally registering multiple passkeys from the same authenticator, reducing credential clutter and avoiding confusion at sign-in.

Response

Enrollment started

​
auth_session
string
required

The unique session identifier for the enrollment.

​
authn_params_public_key
object
required