# [OAuth2.0] Register new user


Creates a new user.
* If you store user data at Xsolla or in custom storage, the user will receive an account confirmation [email](https://developers.xsolla.com/doc/login/how-to/email-customization/).
* If you store user data at PlayFab, you can set up sending the account confirmation email to the user. Use the [PlayFab instruction](https://developers.xsolla.com/doc/login/references/playfab-storage/#recipes_users_storage_playfab_how_it_works_registration_confirmation) for this.
* If you store user data at Firebase, the user will receive an account confirmation message from Firebase side.

See the [Comparison of user data storages](https://developers.xsolla.com/doc/login/references/users-storages-comparison/) page for more information about user data storages.
**Notice**
[Rate limits for client-side methods](/api/login/rate-limits) are applied to this method.

Endpoint: POST /oauth2/user
Version: v1

## Query parameters:

  - `response_type` (string, required)
    Grant type used in your project that has the enabled OAuth 2.0 protocol. Must be `code` to get the user authentication code in the response. The received code must be exchanged to a JWT via the [Generate JWT](https://developers.xsolla.com/api/login/operation/generate-jwt) call to finish user authentication.

  - `client_id` (integer, required)
    Your application ID. Get it after [creating an OAuth 2.0 client](https://developers.xsolla.com/doc/login/features/connecting-oauth2/).

  - `scope` (string)
    Scope is a mechanism in OAuth 2.0 to limit an application’s access to a user’s account.

Can be:
* `email` for [Auth via social network](https://developers.xsolla.com/api/login/operation/oauth-20-auth-via-social-network) or [Get link for social auth](https://developers.xsolla.com/api/login/operation/oauth-20-get-link-for-social-auth) calls to request an email from the user additionally.
* `offline` to use `refresh_token` from [Generate JWT](https://developers.xsolla.com/api/login/operation/generate-jwt) call to refresh the JWT when it is expired.
* `playfab` to write **SessionTicket** to the `session_ticket` claim of the JWT if you store user data at PlayFab.

If you process your own values of the `scope` parameter, that are not mentioned above, you can set them when using this call. The Xsolla Login server does not process these values, but returns them in the received JWT.

  - `audience` (string)
    Identification parameter of the application the token was issued for. Parameter value will be passed in the `aud` JWT field.

  - `state` (string, required)
    Value used for additional user verification. Often used to mitigate [CSRF Attacks](https://en.wikipedia.org/wiki/Cross-site_request_forgery). The value will be returned in the response. Must be longer than 8 symbols.

  - `redirect_uri` (string)
    URL to redirect the user to after account confirmation, successful authentication, or password reset confirmation. To set up this parameter, contact your Customer Success Manager or email to [csm@xsolla.com](mailto:csm@xsolla.com).

{% html name="div" attrs={"class": "notice"} %}
**Notice**

The parameter is required if you have more than one redirect URI in your project settings.
{% /html %}

  - `payload` (string)
    Your custom data. The value of the parameter will be returned in the `payload` claim of the **user JWT**. Recommended maximum length less than 500 characters. Note, that this parameter is only available if you use a custom user data storage.

## Request fields (application/json):

  - `accept_consent` (boolean)
    Whether the user gave consent to processing of their personal data.

  - `email` (string, required)
    User email address.

  - `fields` (object)
    Parameters used for [extended registration form](https://developers.xsolla.com/doc/login/features/extended-registration-form/). To use this feature, please contact your Customer Success Manager.

  - `password` (string, required)
    User password.

  - `username` (string, required)
    Username.

## Response 200 fields (application/json):

  - `login_url` (string)
    URL generated from the `redirect_uri` with additional parameters. The `code` parameter is the user authentication code which must be exchanged to a JWT.

## Response 400 fields (application/json):

  - `error` (object, required)

  - `error.code` (string, required)
    Error code.
    Example: 003-061

  - `error.description` (string, required)
    Error description.
    Example: Object not found.

  - `error.details` (object)
    Additional information.

## Response 404 fields (application/json):

  - `error` (object, required)

  - `error.code` (string, required)
    Error code.
    Example: 003-061

  - `error.description` (string, required)
    Error description.
    Example: Object not found.

  - `error.details` (object)
    Additional information.

## Response 422 fields (application/json):

  - `error` (object, required)

  - `error.code` (string, required)
    Error code.
    Example: 003-061

  - `error.description` (string, required)
    Error description.
    Example: Object not found.

  - `error.details` (object)
    Additional information.

## Response 429 fields (application/json):

  - `error` (object, required)

  - `error.code` (string, required)
    Error code.
    Example: 003-061

  - `error.description` (string, required)
    Error description.
    Example: Object not found.

  - `error.details` (object)
    Additional information.