v132 · security

WebAuthn signal API

Allow WebAuthn relying parties to report information about existing credentials back to credential storage providers, so that incorrect or revoked credentials can be updated or removed from provider and system UI. https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Signal-API-explainer

concepts

  1. WebAuthn Signal

    Sites can signal the authenticator about credential status (unknown, all-accepted, current user). Authenticators clean up stale credentials accordingly.

  2. credential lifecycle

    End-to-end: user adds, renames, deletes credentials; each event fires the right signal method.

  3. Passkey Cleanup Flow

    Simulate registering passkeys, deleting them server-side, then calling signalUnknownCredential() and signalAllAcceptedCredentials() to sync the OS keystore. Watch the credential states update in real time.

  4. RP recipes

    Five concrete RP scenarios — user deletes credential, nightly reconciliation, rename, account close, rotation — with copy-paste snippets for each.

  5. Passkey Sync Dashboard

    Manage a simulated list of passkeys across devices and users. Revoke, mark unknown, or validate individual credentials, then fire the three Signal API calls — reportExistingCredential, reportAllAcceptedCredentials, and reportAllDeletedCredentials — and watch the API log build up.

why it shipped

Discoverable credentials, such as passkeys, can be requested with navigator.credentials.get with an empty allowCredentials. In this case, if a user has any credentials for that relying party, they are presented with some UI to select which credential to use. If the user selects a credential, the resulting assertion carries the user.id value set at registration, allowing the relying party to resolve to an account without any further information.

references