PublicKeyCredentialCreationOptions

PublicKeyCredential is a class defined by the Web Authentication API (WebAuthn) that represents a credential based on public-key cryptography used for user authentication. It is one of the credential types supported by WebAuthn, alongside PasswordCredential.

Instances of PublicKeyCredential are obtained by the client through navigator.credentials.create() when registering a new credential, or navigator.credentials.get() when authenticating with an existing credential.

An instance exposes properties such as id, type (set to 'public-key'), and rawId. Its response property is an object of type PublicKeyCredentialResponse, specialized as AuthenticatorAttestationResponse during creation or AuthenticatorAssertionResponse during authentication.

PublicKeyCredential relies on a key pair generated by a trusted authenticator. The private key remains on the authenticator, while the public key is stored by the server (relying party) for future verifications. Registration includes attestation data; authentication uses a signed challenge. Registration and authentication are driven by a challenge and relying-party parameters, including the rpId, user verification requirements, and allowed transports.

Security and privacy considerations include resistance to phishing, reliance on hardware or platform authenticators, and the possibility to disable or limit attestation for privacy reasons. Attestation can reveal device information, which may be restricted or filtered depending on policy and user choice.

Standards and interoperability: WebAuthn is developed by the W3C; CTAP (Client To Authenticator Protocol) defines the transport between the client and the authenticator, enabling communication with external security keys. Browser support is extensive in modern browsers, with varying support for attestation formats and user verification requirements.

See also: Web Authentication, FIDO2, CTAP, Attestation.