demo · v130 · backend-backed

WebAuthn Signal API workbench

Register a real local passkey against this showcase origin, store the credential ID in the Deno backend, revoke it server-side, then call Chrome's real PublicKeyCredential signal methods with the stored credential IDs.

real browser calls Registration uses navigator.credentials.create() with a server challenge. The signal buttons call the real WebAuthn Signal API when available. If a browser does not expose a method, the page reports that state and does not generate a fake success.

server-side credentials

the code

const options = await fetch("../register-options").then((r) => r.json());
options.publicKey.challenge = base64UrlToBytes(options.publicKey.challenge);
options.publicKey.user.id = base64UrlToBytes(options.publicKey.user.id);

const credential = await navigator.credentials.create(options);
await fetch("../register", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(credential.toJSON())
});

await PublicKeyCredential.signalAllAcceptedCredentials({
  rpId,
  userId,
  allAcceptedCredentialIds,
});

see also