/{app_slug}/v1/auth/signupSign up an EndUser
Create an EndUser account inside the app and immediately mint a session. The supplied email becomes the primary email contact, unverified at signup. When the app has completed Mail notification setup, a verification code is auto-emailed to the address; customers delivering their own verification messages call /auth/request-verification (or /auth/send-verification-email) instead — doing so invalidates the auto-sent code, so the user only ever has one valid code. Subject to the app-configured signup policy (signup enabled, password policy, default role, optional `signup_requires_pak`). The password must clear the app's length + character-class rules, a common-password deny-list, and — unless the app sets `password_breach_check` to `warn` or `off` — a public breach corpus; a breached password is refused with 400 `PASSWORD_BREACHED` and a deny-listed one with 400 `PASSWORD_TOO_COMMON`. The breach lookup is k-anonymous (only five characters of the password's SHA-1 leave the service) and fails open, so an unreachable corpus never blocks a signup. When the app runs `auth_config.mfa: "required"`, the account is still created but NO session is minted: the response is the `ConsumerMfaEnrollmentRequiredResponseDto` shape (`mfa_enrollment_required: true`), completed via `POST /auth/mfa/enroll` + `/auth/mfa/enroll/verify`. Inside `mfa_grace_days` of account creation — which a fresh signup always is when the window is non-zero — the ordinary token pair is returned with `mfa_enrollment_due_at` set instead.
Path parameters
app_slug*stringHeaders
authorization*stringRequest body
username*stringUnique username inside the app. 3-32 characters: letters, numbers, dot, underscore, hyphen. No "@" — a username shaped like an email address would sit in front of that address at sign-in.
Example: "john_doe"
email*stringEndUser email address. Becomes the primary email contact and the default verification target.
Example: "jane@example.com"
password*stringPassword. Must satisfy the app-configured policy (default: 12+ chars, at least one uppercase letter and one digit), must not be on the common-password deny-list, and — unless the app sets `password_breach_check` to `off` or `warn` — must not appear in the public breach corpus.
Example: "CorrectHorseBatteryStaple"
display_namestringOptional display name shown back to the user.
Example: "Jane Doe"
Response · 201 Account created. A session was minted unless `mfa_enrollment_required` is present — branch on that flag.
object
Example
Request
POST /{app_slug}/v1/auth/signup
Content-Type: application/json
{
"username": "john_doe",
"email": "jane@example.com",
"password": "CorrectHorseBatteryStaple",
"display_name": "Jane Doe"
}Response
{}