Currently, FusionAuth does not support forcing the register screen when prompt=login is used with an active SSO session. The screen_hint parameter (like Auth0's screen_hint=signup) is not available in FusionAuth.

Workarounds:

Clear the SSO session before registration: You can clear the existing SSO session in your proxy/middleware before redirecting to oauth2/register. While not ideal, this would allow the registration flow to proceed without the passthrough behavior.

Use direct registration without prompt: If you call the registration endpoint without the prompt=login parameter and there are no missing required fields, FusionAuth will complete the registration directly. Only when there are missing fields will users be sent to the complete-registration page.

Feature Request:

If neither workaround meets your needs, this would require a feature request for FusionAuth to support a parameter similar to screen_hint=signup. The product team would need to review this for the roadmap, though implementation timelines would depend on prioritization.

For now, clearing the SSO session before initiating registration is the most reliable approach to ensure users see the registration screen rather than experiencing passthrough behavior.

Related Documentation OAuth prompt Parameter - Details on the prompt=login parameter and its behavior (available since v1.60.0): OIDC Prompt Documentation OAuth Authorize Endpoint - Complete reference for OAuth authorization parameters including prompt, login_hint, and idp_hint: Authorize API Reference Self-Service Registration - Overview of how self-service registration works and how registrations are created: Self-Service Registration Guide Complete Registration - Information on the complete registration flow when missing fields are present (available since v1.65.0): Complete Registration Documentation Logout and Session Management - How to clear SSO sessions programmatically: Logout and Session Management Hosted Backend API - Documentation on the /oauth2/register endpoint behavior: Hosted Backend API

Note: The /oauth2/register endpoint is not fully documented in the official OAuth endpoints reference. There is an open issue to add complete documentation for this endpoint. When a user has an active SSO session and hits /oauth2/register, FusionAuth redirects them through the authorization flow, which causes the passthrough behavior you're experiencing.

This is totally possible.

You want to start by understanding FusionAuth passkey setup and the normal flow.

Then, in your application, probably using one of the client libraries, you want to do the following for a user:

see if a user has a passkey set up, using the "retrieve a passkey" API. If this returns 0 passkeys, show the prompt. for the prompt, you have two options: use the API/client library to start the passkey registration process from within your application directly send them to the user management page to add a passkey (requires a paid license)

The right way to do the latter depends on your application needs (are you okay with a redirect) and whether or not you have at least a starter license.

For reporting on the number of users that have set up passkeys, unfortunately you have to query all your users and then pull the passkey data individually. There's no way to use the elasticsearch syntax to do the query as of yet. There's an open github issue to add that functionality.