> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Browser-based signup

> Create and activate an Agent account from a browser without exposing an API secret

Use the web-form endpoint when an untrusted browser must create an account directly. Unlike the JSON [Create account](/neuron-api/api-reference/accounts-and-onboarding/create-account) flow, the browser flow uses reCAPTCHA and redirects rather than exposing the account-creation API key to JavaScript.

<Warning>
  Before launch, test the form fields, allowed redirect origins, cookie attributes, CORS behavior, reCAPTCHA settings, and session-token response on the target Neuron.
</Warning>

## Prerequisites

The Neuron operator must:

* configure Google reCAPTCHA;
* create an API key whose owner is `Agent API` and whose account limit has not been reached;
* configure email delivery and, if phone verification is required, SMS delivery;
* serve the signup page over HTTPS.

Removing the API key or setting its limit to the current account count disables public account creation.

## Submit the form

Render the reCAPTCHA widget and submit a normal HTML form to `/Agent/Account/CreateWebForm`:

```html theme={null}
<form method="post" action="https://neuron.example/Agent/Account/CreateWebForm">
  <label>Username <input name="UserName" autocomplete="username" required /></label>
  <label>Email <input name="EMail" type="email" autocomplete="email" required /></label>
  <label>Phone <input name="PhoneNr" type="tel" autocomplete="tel" /></label>
  <label>Password <input name="Password" type="password" autocomplete="new-password" required /></label>
  <input name="RedirectionUrl" type="hidden" value="https://app.example/signup/complete" />
  <!-- Render Google's widget here; it supplies g-recaptcha-response. -->
  <button type="submit">Create account</button>
</form>
```

The endpoint consumes form data, not JSON. The redirect target must be an application URL you trust; do not copy a redirect URL from arbitrary query input.

## Recover the new session

After the Neuron redirects the browser, preserve its session cookie and exchange the creation session for account state:

```js theme={null}
const response = await fetch(
  "https://neuron.example/Agent/Account/GetSessionToken",
  {
    method: "POST",
    credentials: "include",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({})
  }
);

if (!response.ok) throw new Error(`Session exchange failed: ${response.status}`);
const result = await response.json();
```

The created account starts disabled. Ask the user for the code delivered to their email and call [Verify email](/neuron-api/api-reference/accounts-and-onboarding/verify-email). If a phone number was supplied, complete [phone verification](/neuron-api/api-reference/accounts-and-onboarding/verify-phone-number) too.

<Warning>Keep the returned JWT in memory where possible. Never place it in a URL, page source, analytics event, or browser log.</Warning>