Skip to content
mera
Get startedGetting started →

createPasskeyWithPrfOutput

Creates a discoverable, user-verified passkey with the WebAuthn PRF extension enabled and returns its PRF output. It runs one creation ceremony and shows one user-verification prompt; when the authenticator does not evaluate the PRF at create time, it runs getPasskeyPrfOutput with the same salt, which shows a second.

Import

Section titled “Import”
import { createPasskeyWithPrfOutput } from "@category-labs/mera";

Usage

Section titled “Usage”
const { credentialId, prfSalt, prfOutput } = await createPasskeyWithPrfOutput({
  rp: { id: "account.example.com", name: "Example" },
  user: { name: "account@example.com", displayName: "Example account" },
});

Parameters

Section titled “Parameters”

options is a CreatePasskeyWithPrfOutputOptions.

options.rp

Section titled “options.rp”
  • Type: PublicKeyCredentialRpEntity & { id: string }
  • Required, including rp.id

Relying party identity, passed to WebAuthn. rp.id lets the fallback ceremony target the same relying party.

options.user.name

Section titled “options.user.name”
  • Type: string
  • Required

User name displayed or stored by the authenticator.

options.user.displayName

Section titled “options.user.displayName”
  • Type: string
  • Required

Human-readable display name for the authenticator UI.

options.user.id

Section titled “options.user.id”
  • Type: Uint8Array
  • Optional; a fresh 32-byte random handle is generated per call when omitted

User handle stored with the discoverable credential. Must be 1 to 64 bytes when provided (WebAuthn’s user-handle limit).

options.prfSalt

Section titled “options.prfSalt”
  • Type: Uint8Array
  • Optional; defaults to mera’s fixed salt

32-byte PRF salt evaluated during creation or by the fallback assertion. An explicit value supports custom PRF namespaces.

options.timeout

Section titled “options.timeout”
  • Type: number
  • Optional; browser defaults apply when omitted

WebAuthn timeout in milliseconds, applied to each ceremony.

Returns

Section titled “Returns”

Promise<CreatePasskeyWithPrfOutputResult>. Credential metadata (credentialId, transports when reported) plus the 32-byte prfSalt that was evaluated and the 32-byte prfOutput.

Errors

Section titled “Errors”
  • PRF_UNAVAILABLE: the authenticator did not enable PRF, or did not return PRF output on the fallback ceremony.
  • INPUT_INVALID: an explicit prfSalt is not 32 bytes, or the provided user.id length is outside 1 to 64 bytes.
  • CRYPTO_UNAVAILABLE: the page is not in a secure context, or the runtime lacks Web Crypto.
  • PASSKEY_OPERATION_FAILED: WebAuthn is unavailable, cancelled, or returns an unexpected credential.

Notes

Section titled “Notes”

The credential is requested with fixed parameters: ES256 or RS256 key types, attestation "none" (no statement about the authenticator’s make is requested), a required resident key, and required user verification. Resident key is the WebAuthn term for a discoverable credential. The user-verification requirement is not configurable (Passkeys and the PRF extension explains the mechanism).

WebAuthn challenges are generated internally.

Any failure after the creation ceremony completes leaves the passkey on the authenticator: it appears in the authenticator’s passkey list, but the thrown error does not carry its metadata.

See also

Section titled “See also”