createPasskeyWithPrfOutput

Creates a discoverable, user-verified passkey with the WebAuthn PRF extension enabled and returns its PRF output. It runs one creation ceremony and shows one user-verification prompt; when the authenticator does not evaluate the PRF at create time, it runs getPasskeyPrfOutput with the same salt, which shows a second.

Import

import { 
function createPasskeyWithPrfOutput({ rp, user, timeout, prfSalt, webAuthnClient, }: createPasskeyWithPrfOutput.Options): Promise<createPasskeyWithPrfOutput.Result>
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ― 
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
createPasskeyWithPrfOutput } from "@category-labs/mera";

Usage

const { 
const credentialId: string
Credential ID encoded as canonical unpadded base64url.
credentialId, 
const prfSalt: Uint8Array<ArrayBuffer>
PRF salt that WebAuthn evaluated. Always 32 bytes, in a fresh allocation.
prfSalt, 
const prfOutput: Uint8Array<ArrayBuffer>
First WebAuthn PRF output for prfSalt. Always 32 bytes.
prfOutput } = await 
function createPasskeyWithPrfOutput({ rp, user, timeout, prfSalt, webAuthnClient, }: createPasskeyWithPrfOutput.Options): Promise<createPasskeyWithPrfOutput.Result>
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ― 
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
createPasskeyWithPrfOutput({
  
rp: PasskeyRelyingParty
Relying party identity passed to WebAuthn. id is required so the
fallback assertion can target the same relying party.
rp: { 
id: string
Relying party ID: the host the passkey is scoped to.
id: "account.example.com", 
name: string
Relying party name the authenticator may show.
name: "Example" },
  
user: {
    name: string;
    displayName: string;
}
User identity passed to WebAuthn.
user: { 
name: string
User name displayed or stored by the authenticator.
name: "account@example.com", 
displayName: string
Human-readable display name for the authenticator UI.
displayName: "Example account" },
});

Parameters

options is a createPasskeyWithPrfOutput.Options.

options.rp

Type: { id: string; name: string }
Required, including rp.id

Relying party identity, passed to WebAuthn. rp.id lets the fallback ceremony target the same relying party.

options.user.name

Type: string
Required

User name displayed or stored by the authenticator.

options.user.displayName

Type: string
Required

Human-readable display name for the authenticator UI.

options.prfSalt

Type: Uint8Array
Optional; defaults to mera’s fixed salt

32-byte PRF salt evaluated during creation or by the fallback assertion. An explicit value supports custom PRF namespaces.

options.timeout

Type: number
Optional; platform defaults apply when omitted

WebAuthn timeout in milliseconds, applied to each ceremony.

options.webAuthnClient

Type: WebAuthnClient
Optional; defaults to the built-in browser client

Client that runs the ceremonies. WebAuthnClient covers supplying one for a runtime without navigator.credentials.

Returns

import type { 
function createPasskeyWithPrfOutput({ rp, user, timeout, prfSalt, webAuthnClient, }: createPasskeyWithPrfOutput.Options): Promise<createPasskeyWithPrfOutput.Result>
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ― 
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
createPasskeyWithPrfOutput } from "@category-labs/mera";

type 
type ReturnType = Promise<createPasskeyWithPrfOutput.Result>
ReturnType = 
interface Promise<T>
Represents the completion of an asynchronous operation
Promise<
(alias) namespace createPasskeyWithPrfOutput
import createPasskeyWithPrfOutput
Creates a discoverable, user-verified passkey that requires WebAuthn PRF
support and returns the first PRF output.
@param ― options - Passkey creation inputs.
@returns ― Credential metadata and the first PRF output.
@remarks ― 
Runs one creation ceremony and shows one user-verification prompt. On
authenticators that do not evaluate PRF during creation, a fallback
assertion evaluates the same salt and shows a second prompt.
WebAuthn challenges and the credential's user handle (user.id) are
generated internally, 32 random bytes each. An authenticator overwrites a
discoverable credential that has the same rp.id and user.id, so a fresh
handle per call adds a passkey instead of replacing one.
The credential is requested with fixed parameters: ES256 or RS256 key types,
attestation "none", a required resident key, and required user
verification (getPasskeyPrfOutput explains the requirement).
Any failure after the creation ceremony completes leaves the passkey on the
authenticator, but the thrown error does not carry its metadata.
@throws ― MeraError with code PRF_UNAVAILABLE when the authenticator reports no PRF support and returns no create-time output, returns an output that is not 32 bytes, or returns none on the fallback ceremony.
@throws ― MeraError with code INPUT_INVALID when an explicit prfSalt is not 32 bytes.
@throws ― MeraError with code CRYPTO_UNAVAILABLE when crypto.getRandomValues is unavailable.
@throws ― MeraError with code PASSKEY_OPERATION_FAILED when WebAuthn is unavailable, cancelled, or returns an unexpected credential.
createPasskeyWithPrfOutput.
type createPasskeyWithPrfOutput.Result = PasskeyCredentialMetadata & {
    readonly prfSalt: Uint8Array<ArrayBuffer>;
    readonly prfOutput: Uint8Array<ArrayBuffer>;
}
Result of creating a passkey together with its first PRF output.
Result>;

credentialId (string): the new credential ID as canonical unpadded base64url.
transports (readonly PasskeyCredentialTransport[] | undefined): authenticator transports reported by the platform, when available.
prfSalt (Uint8Array<ArrayBuffer>): the 32-byte salt that WebAuthn evaluated.
prfOutput (Uint8Array<ArrayBuffer>): the 32-byte PRF output for prfSalt.

Errors

PRF_UNAVAILABLE: the authenticator reported no PRF support and returned no create-time output, returned an output that is not 32 bytes, or returned none on the fallback ceremony.
INPUT_INVALID: an explicit prfSalt is not 32 bytes.
CRYPTO_UNAVAILABLE: the runtime provides no crypto.getRandomValues.
PASSKEY_OPERATION_FAILED: WebAuthn is unavailable, cancelled, or returns an unexpected credential.

Notes

The credential is requested with fixed parameters: ES256 or RS256 key types, attestation "none" (no statement about the authenticator’s make is requested), a required resident key, and required user verification. Resident key is the WebAuthn term for a discoverable credential. The user-verification requirement is not configurable (Passkeys and the PRF extension explains the mechanism).

WebAuthn challenges and the credential’s user handle (user.id) are generated internally, 32 random bytes each. A fresh handle per call means each call adds a passkey and never overwrites one.

Any failure after the creation ceremony completes leaves the passkey on the authenticator: it appears in the authenticator’s passkey list, but the thrown error does not carry its metadata.