diff --git a/app/__init__.py b/app/__init__.py
index 536553a..e3ec825 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -133,6 +133,7 @@ def create_app(config_name: str = 'development') -> Flask:
     csrf.exempt(folders_bp)
     csrf.exempt(sharing_bp)
     csrf.exempt(emergency_bp)
+    csrf.exempt(webauthn_bp)
 
     # ── Global JSON error handlers ─────────────────────────────────────────────
     # All /api/* routes must return JSON even on unhandled exceptions.