# @didtools/key-webauthn > Implements support to authenticate, authorize and verify blocks produced by webauthn/passkey compatible hardware authenticators and OS/software implementations. Latest version **2.0.2** (published 2024-04-10) · (Apache-2.0 OR MIT) license · 0 weekly downloads ## Install ```sh npm install @didtools/key-webauthn pnpm add @didtools/key-webauthn yarn add @didtools/key-webauthn bun add @didtools/key-webauthn ``` ## Health **Score 30/100 (F)** — status: abandoned. Positive: has types; esm support; no vulnerabilities; high quality score. Warnings: low downloads. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 2.0.2 | | Published | 2024-04-10 | | First published | 2023-12-06 | | Weekly downloads | 0 | | License | (Apache-2.0 OR MIT) | | TypeScript types | bundled | | Module format | ESM + CommonJS | | Node | >=14.14 | | Dependencies | 8 | | Unpacked size | 27.7 KB | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 103 | | Author | 3Box Labs | | Maintainers | dav1do, dbcfd, cb3box, ukstv, jpham2023, oed, paul_lecam | | Keywords | DID, identity, did-provider, self-sovereign, passkey, webauthn | ## Links - npm: https://www.npmjs.com/package/@didtools/key-webauthn - Repository: https://github.com/ceramicnetwork/js-did - Homepage: https://github.com/ceramicnetwork/js-did#readme - Issues: https://github.com/ceramicnetwork/js-did/issues - npm.io page: https://npm.io/package/@didtools/key-webauthn ## Dependencies (8) - [caip](https://npm.io/package/caip.md) ^1.1.0 - [cborg](https://npm.io/package/cborg.md) ^4.0.5 - [varint](https://npm.io/package/varint.md) ^6.0.0 - [uint8arrays](https://npm.io/package/uint8arrays.md) ^5.0.1 - [multiformats](https://npm.io/package/multiformats.md) ^13.0.0 - [@noble/curves](https://npm.io/package/@noble/curves.md) ^1.2.0 - [@ipld/dag-cbor](https://npm.io/package/@ipld/dag-cbor.md) ^9.0.6 - [@didtools/cacao](https://npm.io/package/@didtools/cacao.md) 3.0.1 ## Alternatives - [@sindresorhus/slugify](https://npm.io/package/@sindresorhus/slugify.md) — 3.7M weekly downloads - [solid-js](https://npm.io/package/solid-js.md) — 2.7M weekly downloads - [expo-glass-effect](https://npm.io/package/expo-glass-effect.md) — 2.5M weekly downloads - [nanoassert](https://npm.io/package/nanoassert.md) — 780.8K weekly downloads - [@ffmpeg/ffmpeg](https://npm.io/package/@ffmpeg/ffmpeg.md) — 529.5K weekly downloads ## Recent versions - 2.0.2 (latest) — 2024-04-10 - 2.0.1 — 2024-01-04 - 2.0.0 — 2024-01-04 - 1.0.1 — 2023-12-06 ## README ## Webauthn AuthMethod and Verifier Implements support to authenticate, authorize and verify blocks produced by webauthn/passkey compatible hardware authenticators and OS/software implementations. ## Installation ``` npm install --save @didtools/key-webauthn ``` ## Auth Usage This module is designed to run in browser environments. Create a Credential for first time use: ```js import { WebauthnAuth } from '@didtools/key-webauthn' const did = await WebauthnAuth.createDid('app-user') const authMethod = await WebauthnAuth.getAuthMethod({ did }) const session = await DIDSession.authorize(authMethod, { resources: ['ceramic://nil'] }) ``` ## Verifier Usage Verifiers are needed to verify different did:pkh signed payloads using CACAO. Libraries that need them will consume a verifiers map allowing your to register the verifiers you want to support. ```js import { Cacao } from '@didtools/cacao' import { WebauthnAuth } from '@didtools/key-webauthn' import { DID } from 'dids' const verifiers = { ...WebauthnAuth.getVerifier() } // Directly with cacao Cacao.verify(cacao, { verifiers, ...opts}) // With DIDS, reference DIDS for more details const dids = // configured dids instance await dids.verifyJWS(jws, { capability, verifiers, ...opts}) ``` ## Caveat: DID selection The webauthn+fido2 standard was originally developed for use with databases and at that time a pesudo random `CredentialID` was preferred over the use of public keys. The public key is exported only **once** when the credential is created - spec limitation. There are 3 options for `getAuthMethod()` #### Option 1. Known DID ```js import { WebauthnAuth } from '@didtools/key-webauthn' const authMethod = WebauthnAuth.getAuthMethod({ did: 'did:key:zDn...' }) ``` #### Option 2. Probe Probe the authenticator for public keys by asking user to sign a nonce: ```js import { WebauthnAuth } from '@didtools/key-webauthn' const dids = await WebauthnAuth.probeDIDs() const authMethod = WebauthnAuth.getAuthMethod({ dids }) ``` #### Option 3. Callback Use a callback with the following call signature: ```ts (did1: string, did2: string) => Promise ``` Example that probes on-demand: ```js import { WebauthnAuth } from '@didtools/key-webauthn' const selectDIDs = async (did1, did2) { const dids = await WebauthnAuth.probeDIDs() if (dids.includes(did1)) return did1 else return did2 } const authMethod = WebauthnAuth.getAuthMethod({ selectDIDs }) ``` ## Compatibility Tests done via [demo](https://didtoolswn.surge.sh/). | Browser | Version | OS | Device | Authenticator | Works | Remark | |---------------|---------|----------------|---------|--------------------|-------|---------| | Chrome | 107 | Mac OS 10.15.7 | Desktop | Yubikey v5 (USB-C) | ✅ | | | Safari | 15.6 | Mac OS 10.15.7 | Desktop | Yubikey v5 (USB-C) | ✅ | | | Safari | 15.6 | Mac OS 10.15.7 | Desktop | OS-Authenticator | ✅ | | | Brave | 119 | Mac OS 10.15.7 | Desktop | 1password | ✅ | | | Mobile Safari | 16.6 | iOS 16.6 | Mobile | Yubikey v5 (USB-C) | ✅ | | | Mobile Safari | 16.6 | iOS 16.6 | Mobile | OS-Authenticator | ✅ | | | Chrome | 122 | Windows 10 | Desktop | Yubikey v5 | ✅ | | | Chrome | 122 | Windows 10 | Desktop | GPM+Android device | ❌ | Timeout | | Firefox | 84 | Windows 10 | Desktop | Yubikey v5 | ❌ | e1 | | Firefox | 120 | Windows 10 | Desktop | Yubikey v5 | ✅ | | | Chrome | 116 | Linux | Desktop | Yubikey v5 | ✅ | | | Firefox | 115 | Linux | Desktop | Yubikey v5 | ✅ | | | Chrome | 120 | Android 10 | Mobile | Yubikey v5 | ✅ | e2 | | Chrome | 120 | Android 10 | Mobile | OS-Authenticator | ✅ | | | Firefox | 114 | Android 10 | Mobile | Yubikey v5 | ✅ | e2 | | Firefox | 114 | Android 10 | Mobile | OS-Authenticator | ✅ | | `e1` - An attempt was made to use an object that is not, or is no longer available `e2` - OTG cable was used, when attempting NFC an error message was shown urging USB connection. ## License Apache-2.0 OR MIT --- _Source: https://npm.io/package/@didtools/key-webauthn · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._