> ## Documentation Index
> Fetch the complete documentation index at: https://docs.privy.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Start passkey MFA enrollment

> Returns WebAuthn registration options for a new MFA passkey.



## OpenAPI

````yaml post /v1/users/{user_id}/mfa/passkey/enrollment/init
openapi: 3.1.0
info:
  version: 0.0.1
  title: Privy API
  description: >-
    REST API for Privy's wallet infrastructure — provision and manage wallets
    across EVM, Solana, and Bitcoin, authenticate users, sign transactions, and
    configure programmable policies and authorization intents.
  contact:
    name: Privy
    url: https://www.privy.io/
    email: support@privy.io
servers:
  - url: https://api.privy.io
security: []
tags:
  - name: Accounts
    description: Operations related to asset accounts
  - name: Actions
    description: Operations related to looking up wallet actions across an app
  - name: Aggregations
    description: Operations related to aggregations for tracking and measuring metrics
  - name: Apps
    description: Operations related to app settings and allowlist management
  - name: Cards
    description: Operations related to stablecoin-backed card issuing
  - name: Client Auth
    description: OAuth token exchange and device authorization operations
  - name: Condition Sets
    description: Operations related to condition sets
  - name: Embedded wallets
    description: Operations related to embedded wallet creation and authentication
  - name: Fiat
    description: Operations related to fiat onramping and offramping
  - name: Intents
    description: Operations related to authorization intents for wallet actions
  - name: Key quorums
    description: Operations related to key quorums
  - name: Kraken Embed
    description: >-
      Operations for Kraken Embed integration, including quotes, trades, user
      management, and portfolio operations
  - name: OAuth
    description: >-
      OAuth 2.0 endpoints including Device Authorization Grant (RFC 8628) for
      CLI and limited-input device login flows
  - name: Organizations
    description: Operations related to organizations
  - name: Policies
    description: Operations related to policies
  - name: Shared
    description: Common schemas shared across resources
  - name: Swaps
    description: Operations for swapping tokens within wallets
  - name: Teams
    description: Operations related to dashboard team management
  - name: Transactions
    description: Operations related to transactions
  - name: User signers
    description: Operations related to user signers
  - name: Users
    description: Operations related to users
  - name: Users MFA
    description: Operations related to user MFA
  - name: Wallet Actions
    description: Operations related to wallet actions
  - name: Wallet Automations
    description: Operations related to wallet automations
  - name: Wallets
    description: Operations related to wallets
  - name: Webhooks
    description: >-
      Webhook events that Privy sends to your configured endpoint when specific
      actions occur in your app
  - name: Yield
    description: >-
      Operations for depositing and withdrawing funds from ERC-4626 yield vaults
      (Morpho, Aave)
paths:
  /v1/users/{user_id}/mfa/passkey/enrollment/init:
    post:
      tags:
        - Users MFA
      summary: Start passkey MFA enrollment
      description: Returns WebAuthn registration options for a new MFA passkey.
      operationId: startPasskeyMfaEnrollment
      parameters:
        - schema:
            type: string
          required: true
          name: user_id
          in: path
        - schema:
            type: string
            description: ID of your Privy app.
          required: true
          name: privy-app-id
          in: header
        - schema:
            type: string
            minLength: 1
            description: >-
              Access token or custom authentication JWT for the user the request
              acts on.
          required: true
          description: >-
            Access token or custom authentication JWT for the user the request
            acts on.
          name: privy-user-token
          in: header
        - schema:
            type: string
            minLength: 1
            description: >-
              MFA token from a completed MFA verification, required on
              MFA-protected requests for users with MFA enrolled.
          required: false
          description: >-
            MFA token from a completed MFA verification, required on
            MFA-protected requests for users with MFA enrolled.
          name: privy-mfa-token
          in: header
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyMfaInitRequestBody'
      responses:
        '200':
          description: WebAuthn registration options.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasskeyMfaEnrollmentInitResponse'
      security:
        - appSecretAuth: []
components:
  schemas:
    PasskeyMfaInitRequestBody:
      type: object
      properties:
        relying_party:
          type: string
          format: uri
          description: >-
            Origin where the authenticator runs, such as
            https://app.example.com.
      required:
        - relying_party
      additionalProperties: false
      description: Starts a passkey MFA ceremony for the specified relying party origin.
      title: PasskeyMfaInitRequestBody
      x-stainless-model: users.mfa.passkey_mfa_init_request_body
    PasskeyMfaEnrollmentInitResponse:
      type: object
      properties:
        options:
          $ref: '#/components/schemas/MfaPasskeyAuthenticatorEnrollmentOptions'
      required:
        - options
      additionalProperties: false
      description: WebAuthn registration options for the started passkey MFA enrollment.
      title: PasskeyMfaEnrollmentInitResponse
      x-stainless-model: users.mfa.passkey_mfa_enrollment_init_response
    MfaPasskeyAuthenticatorEnrollmentOptions:
      type: object
      properties:
        rp:
          $ref: '#/components/schemas/MfaPasskeyRelyingParty'
        user:
          $ref: '#/components/schemas/MfaPasskeyUser'
        challenge:
          type: string
        pub_key_cred_params:
          type: array
          items:
            $ref: '#/components/schemas/MfaPasskeyPubKeyCredParam'
        timeout:
          type: number
        exclude_credentials:
          type: array
          items:
            $ref: '#/components/schemas/MfaPasskeyCredentialDescriptor'
        authenticator_selection:
          $ref: '#/components/schemas/MfaPasskeyAuthenticatorSelection'
        attestation:
          type: string
        extensions:
          $ref: '#/components/schemas/MfaPasskeyEnrollmentExtensions'
      required:
        - rp
        - user
        - challenge
        - pub_key_cred_params
      description: >-
        WebAuthn registration options as defined by the Web Authentication
        specification.
      title: MfaPasskeyAuthenticatorEnrollmentOptions
      x-stainless-model: users.mfa.mfa_passkey_authenticator_enrollment_options
    MfaPasskeyRelyingParty:
      type: object
      properties:
        name:
          type: string
        id:
          type: string
      required:
        - name
      description: Relying party information for a WebAuthn ceremony.
      title: MfaPasskeyRelyingParty
      x-stainless-model: users.mfa.mfa_passkey_relying_party
    MfaPasskeyUser:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        display_name:
          type: string
      required:
        - id
        - name
        - display_name
      description: User entity for a WebAuthn registration ceremony.
      title: MfaPasskeyUser
      x-stainless-model: users.mfa.mfa_passkey_user
    MfaPasskeyPubKeyCredParam:
      type: object
      properties:
        alg:
          type: number
        type:
          type: string
          enum:
            - public-key
      required:
        - alg
        - type
      description: >-
        A public key credential parameter specifying the algorithm and
        credential type.
      title: MfaPasskeyPubKeyCredParam
      x-stainless-model: users.mfa.mfa_passkey_pub_key_cred_param
    MfaPasskeyCredentialDescriptor:
      type: object
      properties:
        id:
          type: string
        type:
          type: string
        transports:
          type: array
          items:
            type: string
      required:
        - id
        - type
      description: >-
        A WebAuthn credential descriptor identifying a specific public key
        credential.
      title: MfaPasskeyCredentialDescriptor
      x-stainless-model: users.mfa.mfa_passkey_credential_descriptor
    MfaPasskeyAuthenticatorSelection:
      type: object
      properties:
        authenticator_attachment:
          type: string
        require_resident_key:
          type: boolean
        resident_key:
          type: string
        user_verification:
          type: string
      description: Authenticator selection criteria for a WebAuthn registration ceremony.
      title: MfaPasskeyAuthenticatorSelection
      x-stainless-model: users.mfa.mfa_passkey_authenticator_selection
    MfaPasskeyEnrollmentExtensions:
      type: object
      properties:
        app_id:
          type: string
        cred_props:
          $ref: '#/components/schemas/MfaPasskeyCredPropsResult'
        hmac_create_secret:
          type: boolean
      description: Extensions for a WebAuthn registration ceremony.
      title: MfaPasskeyEnrollmentExtensions
      x-stainless-model: users.mfa.mfa_passkey_enrollment_extensions
    MfaPasskeyCredPropsResult:
      type: object
      properties:
        rk:
          type: boolean
      description: The result of the WebAuthn credProps extension.
      title: MfaPasskeyCredPropsResult
      x-stainless-model: users.mfa.mfa_passkey_cred_props_result
  securitySchemes:
    appSecretAuth:
      type: http
      scheme: basic
      description: >-
        Basic Auth header with your app ID as the username and your app secret
        as the password.

````