Auth0 WebAuthn Passkeys — Passwordless Authentication with Passkeys

// Passkey registration in browser
async function registerPasskey() {
  const registrationOptions = await fetch('/auth/webauthn/register/options', {
    headers: { Authorization: `Bearer ${accessToken}` }
  }).then(res => res.json());

  const credential = await navigator.credentials.create({
    publicKey: {
      challenge: base64url.decode(registrationOptions.challenge),
      rp: { name: 'ScanApp', id: 'scanapp.example.com' },
      user: {
        id: Uint8Array.from(registrationOptions.userId, c => c.charCodeAt(0)),
        name: 'user@example.com',
        displayName: 'User'
      },
      pubKeyCredParams: [{ type: 'public-key', alg: -7 }],
      authenticatorSelection: {
        authenticatorAttachment: 'platform',
        residentKey: 'required',
        userVerification: 'required'
      }
    }
  });

  await fetch('/auth/webauthn/register/complete', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ credential })
  });
}

// Sign in with passkey
async function authenticateWithPasskey() {
  const assertionOptions = await fetch('/auth/webauthn/login/options').then(res => res.json());

  const assertion = await navigator.credentials.get({
    publicKey: {
      challenge: base64url.decode(assertionOptions.challenge),
      allowCredentials: assertionOptions.allowCredentials,
      userVerification: 'required'
    }
  });

  const tokenResponse = await fetch('/auth/webauthn/login/complete', {
    method: 'POST',
    body: JSON.stringify({ assertion })
  }).then(res => res.json());

  return tokenResponse.access_token;
}