Adds a property to an object, or modifies attributes of an existing property.
@param ― o Object on which to add or modify the property. This can be a native JavaScript object (that is, a user-defined object or a built in object) or a DOM object.
@param ― p The property name.
@param ― attributes Descriptor for the property. It can be for a data property or an accessor property.
The relying party ID is the host the passkeys belong to. Use a host name without https:// or a path. The host must list the app in the platform file below.
Replace the package name and fingerprint with those of the Android app. Include every certificate used to sign the app. For a local build, print the debug certificate with:
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ―
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ―
Runs one assertion ceremony and shows one user-verification prompt.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ―
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
createPasskeyWithPrfOutput({
rp: PasskeyRelyingParty
Relying party identity passed to WebAuthn. id is required so the
fallback assertion can target the same relying party.
rp: {
id: string
Relying party ID: the host the passkey is scoped to.
id:
const rpId:"account.example.com"
rpId,
name: string
Relying party name the authenticator may show.
name: "Example" },
user: {
name: string;
displayName: string;
}
User identity passed to WebAuthn.
user: {
name: string
User name displayed or stored by the authenticator.
name: "account@example.com",
displayName: string
Human-readable display name for the authenticator UI.
displayName: "Example account" },
webAuthnClient?: WebAuthnClient |undefined
Client that runs the WebAuthn ceremonies. Defaults to the built-in browser
client, which calls navigator.credentials.
Requests a passkey PRF evaluation and returns the first output.
@param ― options - Passkey PRF request inputs.
@returns ― The selected credential ID and first WebAuthn PRF output.
@remarks ―
Runs one assertion ceremony and shows one user-verification prompt.
The WebAuthn challenge is generated internally.
The default salt is sha256("mera.prf.salt.v1") and will not change across
library versions. The PRF output is a deterministic function of the
credential, rpId, and salt; a different salt yields an unrelated output.
The assertion requires user verification, and the requirement is not
configurable. User verification is the authenticator's local check; the
gesture depends on the platform (a biometric, a device PIN, or a password).
Authenticators built on CTAP's hmac-secret keep two PRFs per credential,
one for user-verified requests and one for the rest; WebAuthn exposes only
the user-verified PRF and overrides a weaker userVerification setting
when evaluating it, so a configurable setting could neither change the PRF
output nor skip the check.