Protocols

WebAuthn

The W3C browser API for creating and using public-key credentials such as passkeys and security keys.

What WebAuthn means

WebAuthn (Web Authentication) is the W3C standard browser API — navigator.credentials.create() and get() — through which websites register and use public-key credentials held by authenticators: platform authenticators like a phone or laptop, or roaming ones like a USB security key.

Defined in: W3C Web Authentication: An API for accessing Public Key Credentials.

How it works

At registration the authenticator returns a new public key and, optionally, an attestation about the authenticator. At authentication it signs a structure including the server's challenge and a hash of the relying party ID; the browser adds the origin. The server verifies all of it.

WebAuthn is the web-facing half of FIDO2; CTAP is the protocol between the browser and an external authenticator.

The mistake people actually make

Skipping origin and RP ID checks on the server because 'the browser enforces them'. The server must verify them itself; the response is just data until it does.

Guides that go deeper

Related terms

Tokens and credentials

Passkey

A phishing-resistant sign-in credential: a key pair, scoped to one website, created and used through WebAuthn.

Sessions

Multi-factor authentication (MFA)

Authentication that requires two or more different kinds of evidence — something you know, have, or are.

All 35 terms

Building on any of this?

Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.