passkeys-web

name	passkeys-web
description	A skill for implementing passkey in web applications. You MUST use this skill whenever a user asks about passkey registartion, passkey authentication or passkey management. It defines the required database schema, API usage, and security best practices.
license	Apache-2.0

Passkeys Implementation Guide (Web)

This skill provides a modular guide to implementing passkeys

Implementation Phase

• Registration: Allowing users to create new passkeys.
• Authentication: Logging users in with passkeys.
• Management: Listing, renaming, and deleting passkeys.
• Reauthentication: Logging users back in with passkeys.

Evaluation

• Evaluate Passkey Skills: Evaluate passkey skills.

References

You MUST read the following references when implementing their respective features:

• Conditional Create: Read this before implementing automatic passkey creation or conditional create.
• Conditional Mediation: Read this before implementing form autofill based passkey authentication.
• Signal API: Read this before implementing any PublicKeyCredential.signal* methods.
• AAGUID Resolution: Read this before saving a new credential to the database during registration to map the provider name and icon.

Recommended Libraries

For backend, using a library is recommended. Here's a list of recommended open source libraries per language:

• JavaScript/TypeScript: SimpleWebAuthn
• Python: py_webauthn
• Java: Java WebAuthn Server , WebAuthn4J, LINE FIDO2 Server
• .Net: .Net library for FIDO2, WebAuthn.Net
• Go: WebAuthn Go Library, Passkey Server
• Ruby: WebAuthn Ruby
• PHP: WebAuthn PHP Library, WebAuthn Framework

If you are using one of the libraries above, use the following skills:

• Use [[simplewebauthn]] skill when implementing passkeys using SimpleWebAuthn