demo · v132

Credential lifecycle: keep the authenticator in sync with your DB

The motivating flow. A user signs in, the RP records the credential, then later the user changes their displayName or deletes a credential on the RP side. Each event calls one of the three signal methods so the authenticator's account chooser stays accurate — no stale entries, no “sign in with X” orphans.

user profile:

event log (server perspective)

// when the RP deletes a credential server-side:
await PublicKeyCredential.signalUnknownCredential({ rpId: location.host, credentialId });

// when the RP renames the user:
await PublicKeyCredential.signalCurrentUserDetails({ rpId: location.host, userId, name, displayName });

// authoritative sync (RP says "these are all the valid credentialIds for this user"):
await PublicKeyCredential.signalAllAcceptedCredentials({ rpId: location.host, userId, allAcceptedCredentialIds });

event log (server perspective)

see also