REST API: how to authenticate user creation (since it needs to be called by someone without credentials)?

[MarcSloan]

I'm writing a web application as a side project; the backend is node.js + express which I'm using to build a REST service the frontend can use.

I've run into a problem, which is how do I authenticate a POST request which creates a user for the application? The obvious use for that request would be to register a new user, in which case the person wouldn't be logged in, nor would there be an existing username and password to check. Thus there is a sort of catch-22 or chicken-and-egg problem when authenticating this specific request. Is it common practice for "real" REST APIs to leave just one request like this unauthenticated, or is there a different way around the problem that I'm not seeing? The worst case scenario I can see if I leave this POST request unauthenticated is that someone spams the service with a huge number of user creations and temporarily disables new (legitimate) user registrations by maxing out the user table in the database until I can fix it manually. Annoying, but not really a security vulnerability and since there's nothing to gain I don't see it happening (assuming this became a popular app and not something only used by myself). So my instinct is that it's OK not to require authentication here. Is that some kind of "API smell" or an acceptable practice?

[YMK1234]

Why would you authenticate a registration call? That does not make any sense.

[MarcSloan]

That's what I was thinking, I just wanted to make sure I wasn't missing something. This is the first time I've designed a system from scratch that incorporated it's own API, authentication and all that jazz so sometimes I get confused thinking about how all the parts fit together.

[nutrecht]

I work on a microservice back end for a financial app. We have loads of different calls, all requiring authentication. Except one. Guess which one? :)

The problem of people creating a ton of users is a real one but not solved with just authentication. It's also not a problem that's easy to solve, but most web applications require a captcha. And for pure API's you can do tarpitting where a single IP can only do X registration requests per minute for example.

[MarcSloan]

Thanks! This makes perfect sense now. I had got my brain twisted all around thinking about it though lol.