Passkeys Developer Resources on passkeys.dev

Related Origin Requests

Thu, 22 Aug 2024 15:20:51 +0000

Use Cases

The two use cases for Related Origin Requests (ROR) are deployments which use different country code top-level domains (ccTLD) across the world, and deployments where different branding is used for different services.

To address these use cases, it is recommended to leverage industry-standard federation protocols such as OpenID Connect. This approach facilitates a centralized login experience, by using a dedicated login page (e.g., login.example.com) that serves as the authentication point for all origins and services.

Backend Requirements

Tue, 13 Aug 2024 12:00:00 +0000

The backend drives WebAuthn ceremonies through four primary responsibilities:

Generate registration options
Verify registration responses
Generate authentication options
Verify authentication responses

The guidance below identifies best practices to fulfill these responsibilities and securely incorporate passkeys-based authentication into your website.

Please note that this is general guidance; it does not account for any one specific server implementation. It is intended to be a launching point. Care should be taken as you consider how best to adapt this guidance for your particular site.

Data Structures

A site that uses passkeys should be prepared to store the following “PasskeyModel” database model:

Demo Sites & Services

Tue, 19 Sep 2023 16:45:00 +0000

General Passkey Demo Sites

webauthn.io

Vendor Demo Sites

These demo sites have been created and are maintained by FIDO2/WebAuthn vendors in the industry.

Bootstrapping

Mon, 10 Oct 2022 19:52:26 +0000

Authenticating the user

This section applies when the Relying Party (RP) does not yet know who is controlling the client device. There is no browser artifact (such as a cookie or a credential ID in local storage) available to the RP, although for now we assume that the user has an existing account with the RP.

To bootstrap an account, serve the user a sign-in page.

Reauthentication

Mon, 10 Oct 2022 19:52:16 +0000

Reauthentication might happen for the following reasons:

The user signed out and now wants to sign in again
The user session expired due to inactivity, and the user wants to sign in again
The user is about to perform a sensitive action, and needs to re-confirm control over the user session

You’ll use passkeys that you set up in the previous section to reauthenticate the user in each of these situations. The WebAuthn API call is the same in all three cases, but the UI treatment that you provide is slightly different. Since the particular account is specified by you, the platform will not offer the user to select a different account on your service.

Libraries

Sat, 24 Sep 2022 16:02:27 +0000

Selection criteria

Companies that want to own passwordless authentication internally, or are looking to implement a turnkey solution for passkeys, will likely look for libraries or vendors. When selecting a library to implement passkeys, what should Relying Party developers keep an eye on?

Note: A small set of these criteria are not specific to passkeys, but are useful to keep in mind when selecting an open-source solution.

Test Sites & Tools

Sat, 24 Sep 2022 16:02:27 +0000

FIDO2/WebAuthn Tools

Basic

Advanced

The “Awesome WebAuthn” GitHub repo is also regularly updated with tools and demos from the community.

What are passkeys?

Sat, 24 Sep 2022 16:02:27 +0000

Passkeys are:

Intuitive

Creating and using passkeys is as simple as consenting to save and use them. No having to create a password.

Automatically unique

Android