---
updatedAt: 2026-04-21T12:52:44.000Z
agentTools:
  projectIndex: https://developer.lemon.markets/llms.txt
---

# Create Authenticator

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "lemon.markets Brokerage API 🍋",
    "version": "0.1.0"
  },
  "x-readme": {
    "proxy-enabled": false,
    "samples-languages": [
      "shell",
      "python",
      "go"
    ]
  },
  "servers": [
    {
      "url": "https://sandbox.api.lemon.markets/v1",
      "description": "Sandbox"
    }
  ],
  "tags": [
    {
      "name": "Accounts: General"
    }
  ],
  "paths": {
    "/accounts/{account_id}/authenticators": {
      "post": {
        "summary": "Create Authenticator",
        "operationId": "create_authenticator",
        "tags": [
          "Accounts: General"
        ],
        "parameters": [
          {
            "name": "account_id",
            "required": true,
            "schema": {
              "title": "Account Identifier",
              "type": "string"
            },
            "in": "path",
            "example": "cusa_c2c3f89ec0524b6e818ce00c16e4897f",
            "description": "An account identifier.\n"
          },
          {
            "required": true,
            "schema": {
              "type": "string",
              "title": "Lmg-Data-Privacy-Access-Principal"
            },
            "name": "LMG-Data-Privacy-Access-Principal",
            "in": "header"
          },
          {
            "required": true,
            "schema": {
              "type": "string",
              "title": "Lmg-Data-Privacy-Access-Justification"
            },
            "name": "LMG-Data-Privacy-Access-Justification",
            "in": "header"
          }
        ],
        "requestBody": {
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/CreateAuthenticatorRequest"
              }
            }
          },
          "required": true
        },
        "responses": {
          "201": {
            "description": "Successful Response",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/AuthenticatorResponse"
                }
              }
            }
          },
          "400": {
            "description": "Bad Request",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "401": {
            "description": "Unauthorized",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "404": {
            "description": "Not Found",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "422": {
            "description": "Unprocessable Entity",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          },
          "5XX": {
            "description": "Server Error",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/ErrorResponse"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "AuthenticatorResponse": {
        "properties": {
          "id": {
            "type": "string",
            "title": "Authenticator Identifier",
            "description": "An authenticator identifier.\n"
          },
          "created_at": {
            "type": "string",
            "format": "date-time",
            "title": "Created At",
            "description": "A timestamp representing the point in time when the authenticator was registered.\n"
          },
          "public_key": {
            "type": "string",
            "title": "Public Key",
            "description": "The base64-url encoded form of the authenticator's public key.  See the guide on strong customer authentication for more information about the format.\n"
          },
          "client_credential_id": {
            "type": "string",
            "title": "Client Credential Identifier",
            "description": "A client-side (read: on-device) identifier for the public key of the authenticator.  Use this identifier to indicate the private key used to create a signature in the two-step verification process or to match the authenticator in a list of authenticated devices.\n**NOTE:** All authenticators associated with a single account must have different values in `client_credential_id`.\n"
          },
          "name": {
            "type": "string",
            "title": "Name"
          }
        },
        "type": "object",
        "required": [
          "id",
          "created_at",
          "public_key",
          "client_credential_id",
          "name"
        ],
        "title": "AuthenticatorResponse",
        "example": {
          "client_credential_id": "adfd5154-c39c-41c5-a88d-f3e6a2aded9e",
          "created_at": "2023-07-28T14:10:33.858446+00:00",
          "id": "sca_8f993645e0954d8ab35198c4c7875fcd",
          "name": "Happy 🍋",
          "public_key": "pSJYIO1qxZIy0bSkO0djjJtdFFVU5K0v1l76XJQba8DNw3xXAQIgAQMmIVggh3uzl_vqfplJX8P3T-rdhEbkO_XX5dDkuGjFO0kRr5w="
        }
      },
      "CreateAuthenticatorRequest": {
        "properties": {
          "name": {
            "type": "string",
            "maxLength": 255,
            "minLength": 1,
            "title": "Name",
            "description": "Name for the authenticator being registered.  When binding to a specific device, it may be a good idea to use the device's model name, like `iPhone14,1`.  This will help when the user has more than one authenticator registered for an account.\n**NOTE:** At the moment, there is no way to register a second authenticator, but this feature will be added in the future.\n"
          },
          "public_key": {
            "type": "string",
            "title": "Public Key",
            "description": "Base64-url encoded form of the public key.  See our guide on strong customer authentication for more details on the formats supported.\n"
          },
          "client_credential_id": {
            "type": "string",
            "maxLength": 255,
            "minLength": 1,
            "title": "Client Credential Identifier",
            "description": "Client side credential identifier of when the key pair was generated.  This identifier will be used to indicate the authenticator that created a signature.\n"
          },
          "recovery_code": {
            "type": "string",
            "minLength": 1,
            "pattern": "^\\d{6}$",
            "title": "Authenticator Recovery Code",
            "description": "When resetting the authenticator, use this property to provide the recovery code from lemon.markets. The format is a six-digit string like `\"123456\"`.\n"
          },
          "verification": {
            "$ref": "#/components/schemas/VerificationRequest"
          }
        },
        "type": "object",
        "required": [
          "name",
          "public_key",
          "client_credential_id"
        ],
        "title": "CreateAuthenticatorRequest",
        "example": {
          "client_credential_id": "adfd5154-c39c-41c5-a88d-f3e6a2aded9e",
          "name": "Happy 🍋",
          "public_key": "pSJYIO1qxZIy0bSkO0djjJtdFFVU5K0v1l76XJQba8DNw3xXAQIgAQMmIVggh3uzl_vqfplJX8P3T-rdhEbkO_XX5dDkuGjFO0kRr5w=",
          "verification": {
            "nonce": "<base64-url encoded random data>",
            "signature": "<base64-url encoded signature for `nonce` using `public_key`>"
          }
        }
      },
      "ErrorResponse": {
        "title": "ErrorResponse",
        "required": [
          "message"
        ],
        "type": "object",
        "properties": {
          "message": {
            "title": "Message",
            "type": "string"
          }
        }
      },
      "VerificationRequest": {
        "description": "An object representing proof of ownership of the private key associated with the public key being registered.\n",
        "properties": {
          "nonce": {
            "type": "string",
            "title": "Nonce",
            "description": "The base64-url encoded form of random data used to create `signature`.\n"
          },
          "signature": {
            "type": "string",
            "title": "Signature",
            "description": "The base64-url encoded DER form of the signature for `nonce` using the private key for the public key that's being registered as an authenticator.\n"
          }
        },
        "type": "object",
        "required": [
          "nonce",
          "signature"
        ],
        "title": "VerificationRequest"
      }
    },
    "securitySchemes": {
      "bearerAuth": {
        "type": "http",
        "scheme": "bearer"
      }
    }
  },
  "security": [
    {
      "bearerAuth": []
    }
  ]
}
```