Create account
Handles account creation with master key authentication.
Creates an account and registers an initial session key in a single operation.
Endpoint
POST /api/v1/auth/accounts
Authentication
Requires a master-key signed request (Secp256k1 or Passkey).
Returns
200 OKwithCreateAccountResponse. A non-successresponse still uses 200 — read thesuccess/session_createdfields to distinguish full success, partial success (account created but session registration failed), and failure.400 Bad Requestif the payload is malformed or the request type does not match the auth flavour.401 Unauthorizedif signature verification fails (raised by the auth extractor).500 Internal Server Errorif the exchange response cannot be parsed.503 Service Unavailableif the request is dropped.
Note: this handler applies the same wall-clock skew check on request_id as the other signed
endpoints, but does not apply rate limiting.
Body
Signed write request from a master key. The JSON body is a Base64SignedPayload (Secp256k1) or a PasskeySignedPayload (passkey — adds WebAuthn authenticator_data, client_data_json, and credential_id, with public_key optional); the wire signature_type selects which. The base64 payload is identical in both and decodes to the binary layout [Header(8) || RequestId(16) || Body || Auth] — see spec/signing.md. The decoded Body is:
CreateSecp256k1AccountwhenHeader.request_type=create_secp256k1_account(15).CreatePasskeyAccountwhenHeader.request_type=create_passkey_account(18).
- Option 1
- Option 2
JSON envelope for a signed request: the base64-encoded canonical payload plus the base64
signature and public_key of the signing credential. Session-key (Ed25519) endpoints accept
exactly these fields; master-key (Secp256k1 / Passkey) endpoints sign the same payload and may
carry additional signature material. Endpoints also accept the equivalent
application/octet-stream binary frame.
Base64-encoded bytes of the canonical request payload.
"AQABAAAAAAB4m2tQz9KvX1Yk2mN3oQ4rS5tU6vW7xZ8aB9cD0eF1gH2iJ3kL5mN7oP9qR1sT3uV5wX7yZ9a="
Base64-encoded public key of the signing credential.
"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
Base64-encoded signature over the payload.
"AAcOFRwjKjE4P0ZNVFtiaXB3foWMk5qhqK+2vcTL0tng5+71/AMKERgfJi00O0JJUFdeZWxzeoGIj5adpKuyuQ=="
Response
Account creation processed; inspect success/session_created