demo · v132

Passkey Cleanup Flow

The WebAuthn Signal API lets servers tell the browser which passkeys are still valid. When a credential is deleted server-side, calling PublicKeyCredential.signalUnknownCredential() tells Chrome's password manager to remove the stale passkey from the OS keystore — no user interaction needed. Simulate the full cleanup lifecycle below.

Simulated passkey store (browser OS keystore)
Register a passkey to start…

Server-side sync state

Server credential database
(empty)
Signal API calls made
(none)
// Server: user deleted their passkey from account settings
// → Tell the browser to clean up
async function notifyBrowserOfDeletion(credentialId) {
  await PublicKeyCredential.signalUnknownCredential({
    rpId: window.location.hostname,
    credentialId: credentialId
  });
  // Browser's OS keystore now removes this passkey
  // User won't be offered a broken passkey on next sign-in
}

// Server: list all valid credentials after sign-in
// → Sync the full set so browser can prune stale entries
async function syncAllCredentials(userCredentials) {
  await PublicKeyCredential.signalAllAcceptedCredentials({
    rpId: window.location.hostname,
    userId: new Uint8Array(btoa(userId).split('').map(c => c.charCodeAt(0))),
    allAcceptedCredentialIds: userCredentials.map(c => c.id)
  });
}

see also