WebAuthn / Passkeys

Overview

WebAuthn (Web Authentication) lets users authenticate with biometrics (Face ID, Touch ID, Windows Hello) or hardware keys (YubiKey) instead of passwords. Passkeys are WebAuthn credentials synced across devices via iCloud Keychain, Google Password Manager, or 1Password.

Key concepts:

• Relying Party (RP): Your server — verifies credentials
• Authenticator: Device/platform (Touch ID, Face ID, YubiKey)
• Credential: Public/private key pair — private key never leaves device
• Challenge: Server-issued random bytes — prevents replay attacks

Setup

Install @simplewebauthn