WebAuthn Preregistration

The WebAuthn Preregistration API provides a flow to initiate and set up WebAuthn preregistration authenticator enrollments through third-party fulfillment providers.

Note: For information about using WebAuthn preregistration with YubiKeys, see Require phishing-resistant authentication with pre-enrolled YubiKey.

Use the following sequence of endpoints to set up WebAuthn preregistration authenticator enrollments.

1. Generate a fulfillment request
2. Enroll a preregistered WebAuthn factor
3. Activate a preregistered WebAuthn factor

After you set up the preregistered WebAuthn factor, you can send the PIN to the user.

Note: As of the 2026.04.0 release, the FIDO2 (WebAuthn) authenticator is now called Passkey (FIDO2 WebAuthn), and there are new settings and updates to the authenticator page layout. There have been no changes to any existing parameter names, values, or endpoint paths. For example, the authenticator key for the Passkey (FIDO2 WebAuthn) authenticator is still webauthn.

See Passkeys and WebAuthn.