Browser-based signup

Before launch, test the form fields, allowed redirect origins, cookie attributes, CORS behavior, reCAPTCHA settings, and session-token response on the target Neuron.

Prerequisites

The Neuron operator must:

configure Google reCAPTCHA;

create an API key whose owner is Agent API and whose account limit has not been reached;

configure email delivery and, if phone verification is required, SMS delivery;

serve the signup page over HTTPS.

Removing the API key or setting its limit to the current account count disables public account creation.

Submit the form

Render the reCAPTCHA widget and submit a normal HTML form to /Agent/Account/CreateWebForm:

<form method="post" action="https://neuron.example/Agent/Account/CreateWebForm">
  <label>Username <input name="UserName" autocomplete="username" required /></label>
  <label>Email <input name="EMail" type="email" autocomplete="email" required /></label>
  <label>Phone <input name="PhoneNr" type="tel" autocomplete="tel" /></label>
  <label>Password <input name="Password" type="password" autocomplete="new-password" required /></label>
  <input name="RedirectionUrl" type="hidden" value="https://app.example/signup/complete" />
  <!-- Render Google's widget here; it supplies g-recaptcha-response. -->
  <button type="submit">Create account</button>
</form>

The endpoint consumes form data, not JSON. The redirect target must be an application URL you trust; do not copy a redirect URL from arbitrary query input.

Recover the new session

After the Neuron redirects the browser, preserve its session cookie and exchange the creation session for account state:

const response = await fetch(
  "https://neuron.example/Agent/Account/GetSessionToken",
  {
    method: "POST",
    credentials: "include",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({})
  }
);

if (!response.ok) throw new Error(`Session exchange failed: ${response.status}`);
const result = await response.json();

The created account starts disabled. Ask the user for the code delivered to their email and call Verify email. If a phone number was supplied, complete phone verification too.

Keep the returned JWT in memory where possible. Never place it in a URL, page source, analytics event, or browser log.

Build with Neuro

Verified identity

Sign in with Neuro

Digital signatures

Agreements

Contract concepts

Tokenized assets

Payments

AI applications

Messaging and events

Example applications

Prerequisites

Submit the form

Recover the new session

​Prerequisites

​Submit the form

​Recover the new session

Prerequisites

Submit the form

Recover the new session