# Sign up for an account

> Creating an account at /register — validation, the captcha, loading and failure states, sign-up being closed, and where a new account goes next.

**Create one** on the sign-in screen opens `/register` with the application's request, and
**Sign in** there goes back. Self-registration needs `auth.registration.enabled`, which is
off by default.

```mermaid
flowchart LR
  L["/login"] -->|Create one| R["/register"]
  R -->|Sign in| L
  R -->|submit| S{New account}
  S -->|address must be verified| V["/verify-email"]
  S -->|second factor required| M["/mfa/setup"]
  S -->|consent needed| C["/consent"]
  S -->|otherwise| CB([Back to the application])
```

## The screen

<StoryScreenshot id="screens-register--default" alt="Create your account: email, password and confirmation" />

The form asks for an email address and a password typed twice. Before anything is sent it
checks that the address is one, that the password has 8 to 128 characters and that the
two match, and marks each field that is not. Characters are counted as the server counts
them, so an emoji counts once; a pasted password that is too long is refused with the
reason, never cut short. The server then holds the password to
`auth.password.min_length` and `auth.password.max_length` (8 and 128 by default), and
marks the field with its reason when it refuses one.

Unless `auth.captcha.provider` is `none`, every sign-up solves a captcha: the built-in
`altcha` proof-of-work, the default, runs in the browser while the user types, or a hosted
provider's widget appears above the button.

<StoryScreenshot id="screens-register--with-social-providers" alt="Create your account with identity-provider buttons above the form" />
<StoryScreenshot id="screens-register--submitting" alt="Sign-up submitting: the button spins and the form is locked" />

## When it does not work

- **The address already has an account:** *An account with this email already exists. Try
  signing in instead. If you were invited, check your email for a new invitation.* An
  address that [waits on an invitation](https://www.nauthera.io/docs/v1/sign-in-flows/emailed-links#coming-back-without-the-link)
  gets the same answer, and its owner is emailed a new invitation.
- **The server refused a field:** the banner points at the fields, and each shows its
  reason.
- **The server failed:** a banner with a reference ID. What was typed stays, and
  submitting again works.
- **Too many sign-ups from here:** the throttle screen, with the wait and **Try again**.

<StoryScreenshot id="screens-register--with-error" alt="Sign-up failed: an account with this email already exists" />
<StoryScreenshot id="screens-register--with-field-errors" alt="Sign-up failed with each refused field marked" />

## Sign-up is closed

While `auth.registration.enabled` is off, the default, the sign-in screen has no **Create
one** link, and `/register` says sign-up is closed, with a way back to sign in; the server
refuses `POST /v1/auth/register` with `403 registration_disabled` either way. The switch is
server-wide, so it opens or closes sign-up in every organization at once; there is no
per-organization switch. It also decides whether a first sign-in
through an [identity provider](https://www.nauthera.io/docs/v1/sign-in-flows/social-sign-in) may create an
account.

<StoryScreenshot id="screens-register-sign-up-closed--default" alt="Sign-up is closed, with Back to login" />

## Where a new account goes

In this order, the first that applies:

1. **The organization requires a verified address**
   ([how to turn it on](https://www.nauthera.io/docs/v1/login-experience#password-reset-and-address-verification)):
   the account is created without a session and a verification link is emailed.
   The user lands on [Verify your email](https://www.nauthera.io/docs/v1/sign-in-flows/emailed-links#verify-an-address),
   and signs in once the address is verified.
2. **A second factor is required:** forced enrolment at
   [`/mfa/setup`](https://www.nauthera.io/docs/v1/sign-in-flows/second-factor#set-up-a-second-factor). Signing up is
   never a way around it.
3. **The request asks for consent:** [`/consent`](https://www.nauthera.io/docs/v1/sign-in-flows/consent-and-devices).
4. Otherwise the new account is signed in and returned to the application.

A sign-up opened from a bare `/register` link, with no application in it, ends on the
[return screen](https://www.nauthera.io/docs/v1/sign-in-flows/errors#return-to-your-app) once the account exists.