v148 · Web Authentication · Security

Silent Auth Flow

Run the authentication cascade against the real Credential Management API: try mediation: "immediate", fall back to mediation: "conditional", then modal if needed. The result reflects this browser, origin, and saved credential state.

Checking navigator.credentials.get() support…

Live request options:

Step 1

immediate

Fast, no UI. Rejects instantly if no passkey.

idle

Step 2 (fallback)

conditional

Shows autofill suggestion if credential found.

idle

Outcome

Auth result

User is signed in or flow abandoned.

idle

Choose request options and click "Run auth flow".

Implementation pattern

async function signIn() {
  // 1. Try immediate — zero latency, zero UI if no passkey
  try {
    const cred = await navigator.credentials.get({
      mediation: 'immediate',
      publicKey: { /* ... rpId, challenge, etc */ },
    });
    return cred; // ← passkey found and used instantly
  } catch(e) {
    if (e.name !== 'NotAllowedError') throw e;
    // NotAllowedError = no credential → fall through
  }

  // 2. Conditional — autofill integration (non-blocking)
  try {
    const cred = await navigator.credentials.get({
      mediation: 'conditional',
      publicKey: { /* ... */ },
    });
    return cred;
  } catch(e) {
    if (e.name !== 'NotAllowedError') throw e;
  }

  // 3. Full modal UI — user explicitly triggered sign-in
  return navigator.credentials.get({
    mediation: 'required',
    publicKey: { /* ... */ },
  });
}

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗