demo · v132

Five RP recipes for Signal API

The three Signal API methods cover most relying-party needs. Here are five concrete recipes — when each fires, what payload to send, and how the credential store should react.

checking support…

1. user deletes credential from RP UI PublicKeyCredential.signalUnknownCredential

RP sees the credential ID is no longer associated with any user account. Tell the credential store to drop it from the user's autofill picker.

await PublicKeyCredential.signalUnknownCredential({
  rpId: "rp.example",
  credentialId: removedCredentialId, // base64url
});

2. RP user list reconciliation PublicKeyCredential.signalAllAcceptedCredentials

Nightly job: enumerate the credentials the RP knows about for a user. Anything not in the list, the credential store can prune.

await PublicKeyCredential.signalAllAcceptedCredentials({
  rpId: "rp.example",
  userId: pat.id,
  allAcceptedCredentialIds: [cred1, cred2, cred3],
});

3. user renames account from RP UI PublicKeyCredential.signalCurrentUserDetails

The user's display name changed. Push the update so the credential picker label updates too.

await PublicKeyCredential.signalCurrentUserDetails({
  rpId: "rp.example",
  userId: pat.id,
  name: "pat@new-handle.example",
  displayName: "Pat (updated)",
});

4. account closed signalAllAcceptedCredentials

User closes their account at the RP. Pass an empty list so the credential store knows there are no valid credentials.

await PublicKeyCredential.signalAllAcceptedCredentials({
  rpId: "rp.example",
  userId: closedUserId,
  allAcceptedCredentialIds: [],
});

5. credential rotated signalUnknownCredential + new create()

User rotates a credential. The RP signals the old one is no longer accepted, then registers the new one via navigator.credentials.create().

await PublicKeyCredential.signalUnknownCredential({
  rpId: "rp.example",
  credentialId: oldCred,
});
// then navigator.credentials.create({...}) for the new key

see also