v148 · Security · Web Authentication

Web Authentication Immediate UI mode

A new mediation: "immediate" option for navigator.credentials.get() — shows the browser sign-in UI only if a passkey or password is already known for the site, and rejects instantly with NotAllowedError if there is none.

concepts

  1. Immediate vs Conditional UI

    Side-by-side comparison of mediation: "immediate" versus mediation: "conditional" versus mediation: "required". Trigger each and observe how the browser responds when no credentials exist.

    Live API WebAuthn Passkeys

  2. Credential Availability Gate

    Demonstrates how to use "immediate" as a gate: try it first; if it rejects, fall through to a traditional sign-in form. Zero prompts for users with no credentials, instant for users who do.

  3. Silent Auth Flow

    The full recommended cascade: try mediation: "immediate" → fall back to "conditional" → modal. Pick a scenario (passkey registered, no credential, password only) and step through the animated flow to see which stage resolves it.

  4. Passkey Flow Visualizer

    Animated step-by-step comparison of all three mediation modes running simultaneously. A timing chart shows time-to-UI for modal, conditional, and immediate. A passkey manager panel queries navigator.credentials.get() with mediation: "immediate" and surfaces the result. A feature-detect table checks isConditionalMediationAvailable(), platform authenticator, and Chrome 148 immediate mode support.

  5. Error Recovery Guide

    Pick from 5 failure scenarios (passkey found, no credential, user timeout, caller abort, insecure origin) and watch an animated step-by-step recovery cascade play out. Each step shows the call made, the error received, and the correct fallback action. Includes a full error reference table mapping every possible rejection to its recommended recovery.

why it shipped

The Credential Management API offers mediation: "conditional" (fill autocomplete suggestions silently) and mediation: "required" (always show the picker). But sites needed a middle mode: "show the picker only if you have something to offer." Without it, every page had to choose between always annoying users with a picker, or never showing one at all. mediation: "immediate" fills this gap: it resolves if the browser has a matching passkey or password, and rejects with NotAllowedError otherwise — letting sites display a sign-in form only for users who have no credentials, while offering a frictionless one-tap sign-in for everyone else.

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗