Complete User Registration

Completes the user registration process and creates the user’s initial credentials.

All credentials submitted in this call (firstFactorCredential, secondFactorCredential, recoveryCredential) sign the same challenge returned by the registration init endpoint (Create Registration Challenge, Create Delegated Registration Challenge, or Create Social Registration Challenge).

Always include a recoveryCredential for end users. Without one, a user who loses their device cannot recover access and you must initiate a delegated recovery manually. See Implement end-user recovery.

The type of credentials being registered is determined by the credentialKind field in the nested objects (firstFactorCredential , secondFactorCredential and recoveryCredential). Supported credential kinds are:

• Fido2: User action is signed by a user’s signing device using WebAuthn.
• Key: User action is signed by a user’s, or token’s, private key.
• PasswordProtectedKey: User action is signed by a user’s, or token’s, private key. The encrypted version of the private key is stored by Dfns and returns during the signing flow for the user to decrypt it.
• RecoveryKey : Similar to PasswordProtectedKey, but this credential can only be used to recover an account not to sign an action or login. Once this credential is used all the other user’s credentials are invalidated.