Skip to content
mera
Get startedGetting started →

getPasskeyPrfOutput

Runs one navigator.credentials.get() ceremony and returns the passkey’s PRF output.

Import

Section titled “Import”
import { getPasskeyPrfOutput } from "@category-labs/mera";

Usage

Section titled “Usage”
const { credentialId, prfOutput } = await getPasskeyPrfOutput({
  rpId: "account.example.com",
});

Parameters

Section titled “Parameters”

options is a GetPasskeyPrfOutputOptions.

options.rpId

Section titled “options.rpId”
  • Type: string
  • Required

Relying party ID for the WebAuthn assertion.

options.credential

Section titled “options.credential”
  • Type: PasskeyCredentialMetadata
  • Optional; when omitted, WebAuthn may choose any discoverable credential for the relying party

Credential metadata that restricts the assertion to one passkey: a credentialId in canonical unpadded base64url, plus the transports reported when it was created.

options.prfSalt

Section titled “options.prfSalt”
  • Type: Uint8Array
  • Optional; defaults to mera’s fixed salt

PRF salt as 32 raw bytes. An explicit value supports custom PRF namespaces.

options.timeout

Section titled “options.timeout”
  • Type: number
  • Optional; browser defaults apply when omitted

WebAuthn timeout in milliseconds.

Returns

Section titled “Returns”

Promise<PasskeyPrfResult>: the credentialId the browser actually selected (canonical unpadded base64url) and the 32-byte prfOutput. When credential was omitted, the person picks the passkey in the browser UI, so the returned ID can name a different credential than the app expected.

Errors

Section titled “Errors”
  • PRF_UNAVAILABLE: the authenticator did not return a usable 32-byte PRF output.
  • INPUT_INVALID: an explicit prfSalt is not 32 bytes, or credential.credentialId is empty or not canonical base64url.
  • CRYPTO_UNAVAILABLE: the page is not in a secure context, or the runtime lacks Web Crypto.
  • PASSKEY_OPERATION_FAILED: WebAuthn is unavailable, cancelled, or returns an unexpected credential.

Notes

Section titled “Notes”

When prfSalt is omitted, the default salt is used: sha256("mera.prf.salt.v1"). The salt will not change across library versions, and another implementation can reproduce the output from the same constant.

The assertion requires user verification, and the requirement is not configurable (Passkeys and the PRF extension explains the mechanism).

The WebAuthn challenge is generated internally.

See also

Section titled “See also”