Browser-based signup

All Agent API calls need Referer. Browsers manage this header; the fetch examples use the page origin and strict-origin policy. See required request headers. Use the web-form endpoint when an untrusted browser must create an account directly. Unlike the JSON Create account flow, the browser flow uses reCAPTCHA and redirects rather than exposing the account-creation API key to JavaScript. Before launch, test the signup and redirect flow with your application’s actual origin, cookie settings, and reCAPTCHA configuration.

Prerequisites

The Neuron operator must:

configure Google reCAPTCHA;
create an API key whose owner is Agent API and whose account limit has not been reached;
configure email delivery and, if phone verification is required, SMS delivery;
serve the signup page over HTTPS.

Removing the API key or setting its limit to the current account count disables public account creation.

Submit the form

Serve the signup page with Referrer-Policy: strict-origin so the browser includes its origin as Referer when submitting the form. Render the reCAPTCHA widget and submit a normal HTML form to /Agent/Account/CreateWebForm:

<form method="post" action="https://neuron.example/Agent/Account/CreateWebForm">
  <label>Username <input name="UserName" autocomplete="username" required /></label>
  <label>Email <input name="EMail" type="email" autocomplete="email" required /></label>
  <label>Phone <input name="PhoneNr" type="tel" autocomplete="tel" /></label>
  <label>Password <input name="Password" type="password" autocomplete="new-password" required /></label>
  <input name="RedirectionUrl" type="hidden" value="https://app.example/signup/complete" />
  <!-- Render Google's widget here; it supplies g-recaptcha-response. -->
  <button type="submit">Create account</button>
</form>

The endpoint consumes form data, not JSON. The redirect target must be an application URL you trust; do not copy a redirect URL from arbitrary query input.

Recover the new session

After the Neuron redirects the browser, preserve its session cookie and exchange the creation session for account state:

const response = await fetch(
  "https://neuron.example/Agent/Account/GetSessionToken",
  {
    method: "POST",
    credentials: "include",
    referrer: window.location.origin + "/",
    referrerPolicy: "strict-origin",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({})
  }
);

if (!response.ok) throw new Error(`Session exchange failed: ${response.status}`);
const result = await response.json();

The created account starts disabled. Ask the user for the code delivered to their email and call Verify email. If a phone number was supplied, complete phone verification too.

Keep the returned JWT in memory where possible. Never place it in a URL, page source, analytics event, or browser log.

Build an application

Verified identity

Sign-in and signatures

Contracts and agreements

Tokens and digital assets

Wallets and payments

Other application tasks

Reports

Prerequisites

Submit the form

Recover the new session

​Prerequisites

​Submit the form

​Recover the new session

Prerequisites

Submit the form

Recover the new session