Passkey / WebAuthn Config Generator

Passwords are shared secrets — you create one and the server stores a hash. They can be phished, leaked in breaches, or brute-forced. Passkeys use public-key cryptography: your device generates a key pair, stores the private key in a secure enclave (never leaves the device), and shares only the public key with the server. Authentication is a cryptographic challenge-response — there is nothing to phish or steal from the server, and passkeys are inherently phishing-resistant because they are scoped to a specific domain.

FIDO2 is the umbrella standard by the FIDO Alliance, composed of two specifications: WebAuthn (Web Authentication API, a W3C spec implemented by browsers) and CTAP (Client-to-Authenticator Protocol, which defines how browsers communicate with external authenticators like YubiKeys). When you implement 'passkeys' or 'WebAuthn' in a web app, you are building on FIDO2. Passkeys are a consumer-friendly brand name for discoverable FIDO2 credentials (resident keys) that can sync across devices via iCloud Keychain, Google Password Manager, or 1Password.

The rpId (Relying Party ID) must be a valid domain that is a registrable suffix of your origin. If your app is at 'app.example.com', valid rpIds are 'app.example.com' or 'example.com'. You cannot use an IP address or 'localhost' in production. If the rpId doesn't match, the browser will throw a SecurityError and the credential will not be created/used. Critically, credentials are permanently scoped to the rpId they were created with — you cannot migrate passkeys from one rpId to another, so choose carefully (typically your apex domain).

A resident key (now called 'discoverable credential' in the spec) stores the credential on the authenticator itself rather than server-side. Without a resident key, you must pass 'allowCredentials' during authentication (requiring a username step to look up credentials). With a resident key, the authenticator can find the right credential automatically — enabling true passwordless flows where the user just touches their device without entering a username. For passkeys (the Apple/Google/Microsoft spec), residentKey: 'required' or 'preferred' is mandatory. Set it to 'required' for a pure passkey experience.

Attestation is a cryptographic statement from the authenticator manufacturer proving what type of authenticator created the credential (e.g., 'this is a genuine YubiKey 5 NFC' or 'this came from an Apple Secure Enclave'). For most consumer apps, use attestation: 'none' — it maximizes compatibility and privacy (many platform authenticators anonymize attestation anyway). Use 'direct' attestation only for high-assurance enterprise scenarios (government, financial) where you need to verify the specific hardware model. Note that Apple's Touch ID and Face ID always return anonymized attestation regardless of your setting to protect user privacy.

Install @simplewebauthn/server and use generateRegistrationOptions() / verifyRegistrationResponse() for registration, and generateAuthenticationOptions() / verifyAuthenticationResponse() for sign-in. In your database, store per-credential: credentialID (unique identifier, base64url), credentialPublicKey (COSE-encoded public key bytes), counter (anti-replay, increment on each authentication), and the user association. The challenge must be stored temporarily (Redis or session) between generating options and verifying the response — never reuse challenges. Also store the AAGUID if you want to identify authenticator types.