> ## Documentation Index > Fetch the complete documentation index at: https://docs.server.express/llms.txt > Use this file to discover all available pages before exploring further. # Create an account > Creates a client account with a billing profile and signs it in straight away (201 with a session). A confirmation email goes out in the background; a mail failure doesn't fail the signup. Throwaway email domains are refused. Countries under sanctions or compliance restrictions get 403. Requires a Cloudflare Turnstile token. Rate-limited to 10 requests per 15 minutes per IP. Attribution fields are sanitised hard — anything that looks like a credential or an email address is dropped, the landing path keeps only its path and the referrer only its host. Writes a REGISTER audit entry recording marketing consent. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/auth/register openapi: 3.1.0 info: title: Server.Express API version: 1.0.0 description: >- The customer-facing Server.Express API: auth, billing, tickets, cloud and dedicated servers, hosting, reselling and account management. Every response uses the `{ success, data | error }` envelope. contact: name: Server.Express url: https://server.express servers: - url: https://my.server.express/api description: Production security: - bearerAuth: [] - apiToken: [] tags: - name: API Tokens - name: Account - name: Auth - name: Cloud - name: Coupons - name: Credits - name: Dashboard - name: Dedicated - name: Health - name: Hosting - name: Integrations - name: Invoices - name: Livechat - name: Notifications - name: Passkeys - name: Payments - name: Products - name: Public - name: Public Invoices - name: Public Tools - name: Reseller - name: SSH Keys - name: Services - name: Tasks - name: Teams - name: Tickets - name: Web Hosting - name: Webhooks paths: /v1/auth/register: post: tags: - Auth summary: Create an account description: >- Creates a client account with a billing profile and signs it in straight away (201 with a session). A confirmation email goes out in the background; a mail failure doesn't fail the signup. Throwaway email domains are refused. Countries under sanctions or compliance restrictions get 403. Requires a Cloudflare Turnstile token. Rate-limited to 10 requests per 15 minutes per IP. Attribution fields are sanitised hard — anything that looks like a credential or an email address is dropped, the landing path keeps only its path and the referrer only its host. Writes a REGISTER audit entry recording marketing consent. operationId: publicAuthRegister requestBody: required: true content: application/json: schema: type: object required: - email - password - firstName - lastName - addressLine1 - city - postcode - country - turnstileToken properties: email: type: string format: email description: >- Must match `^[^\s@]+@[^\s@]+\.[^\s@]+$`. Stored lowercased and trimmed. password: type: string minLength: 8 firstName: type: string lastName: type: string turnstileToken: type: string description: Cloudflare Turnstile token (action `register`). phoneNumber: type: string clientType: type: string enum: - INDIVIDUAL - BUSINESS default: INDIVIDUAL description: Anything other than BUSINESS is treated as INDIVIDUAL. companyName: type: string description: Required when clientType is BUSINESS. Ignored otherwise. vatNumber: type: string description: Kept only for BUSINESS accounts. addressLine1: type: string addressLine2: type: string city: type: string region: type: - string - 'null' maxLength: 64 description: >- State / province / county. Required for countries whose addresses use one. postcode: type: string country: type: string minLength: 2 maxLength: 2 description: ISO 3166-1 alpha-2 code. Uppercased before checks. marketingConsent: type: boolean description: >- Only a literal JSON `true` counts as consent. Anything else is stored as no. attribution: $ref: '#/components/schemas/PublicAuthAttributionInput' responses: '201': description: Account created and signed in. content: application/json: schema: type: object required: - success - data properties: success: type: boolean const: true data: $ref: '#/components/schemas/PublicAuthSession' '400': $ref: '#/components/responses/BadRequest' '403': description: The billing country is one we can't serve. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: That email address is already registered. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' security: [] components: schemas: PublicAuthAttributionInput: type: object description: >- Where the visitor came from. All optional. Values that look like credentials or email addresses are dropped whole, and nothing is stored when every field ends up empty. properties: landingPath: type: string description: >- Path only; query and fragment are stripped. Must start with a single `/`. Capped at 512. referrer: type: string description: Full http(s) URL. Only the hostname is kept. utmSource: type: string description: >- Lowercased; letters, digits, `.`, `_`, `-`, `+` and spaces only. Capped at 128. utmMedium: type: string description: Same rules as utmSource. utmCampaign: type: string description: Same rules as utmSource. partnerCode: type: string description: >- Uppercased; must match `^[A-Z0-9][A-Z0-9._-]{0,63}$` or it's dropped. PublicAuthSession: type: object required: - accessToken - refreshToken - user properties: accessToken: type: string description: >- Access JWT, good for 15 minutes. Send as `Authorization: Bearer `. refreshToken: type: string description: >- Opaque refresh token (`se_rt_…`), good for 30 days and rotated on every use. user: $ref: '#/components/schemas/PublicAuthSessionUser' ErrorResponse: type: object required: - success - error properties: success: type: boolean const: false error: type: string description: Human-readable error message. additionalProperties: true PublicAuthSessionUser: type: object required: - id - email - firstName - lastName - role properties: id: type: string format: uuid email: type: string format: email firstName: type: string lastName: type: string role: type: string enum: - CLIENT - ADMIN responses: BadRequest: description: Validation failed or the request is malformed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TooManyRequests: description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServerError: description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope. apiToken: type: http scheme: bearer bearerFormat: se_live__ description: >- Personal API token created under Settings → API tokens. Only routes guarded by verifyApiAuth accept it, and the token must carry the scope named in the operation's x-required-scope. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.