PublicKeyCredential

Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.

The PublicKeyCredential interface provides information about a public key / private key pair, which is a credential for logging in to a service using an un-phishable and data-breach resistant asymmetric key pair instead of a password. It inherits from Credential, and was created by the Web Authentication API extension to the Credential Management API. Other interfaces that inherit from Credential are PasswordCredential and FederatedCredential.

Note: This API is restricted to top-level contexts. Use from within an <iframe> element will not have any effect.

Instance properties

PublicKeyCredential.type Read only Secure context: Inherited from Credential. Always set to public-key for PublicKeyCredential instances.
PublicKeyCredential.id Read only Secure context: Inherited from Credential and overridden to be the base64url encoding of PublicKeyCredential.rawId.
PublicKeyCredential.rawId Read only Secure context: An ArrayBuffer that holds the globally unique identifier for this PublicKeyCredential. This identifier can be used to look up credentials for future calls to CredentialsContainer.get.
PublicKeyCredential.response Read only Secure context: An instance of an AuthenticatorResponse object. It is either of type AuthenticatorAttestationResponse if the PublicKeyCredential was the results of a navigator.credentials.create() call, or of type AuthenticatorAssertionResponse if the PublicKeyCredential was the result of a navigator.credentials.get() call.

Static methods

PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() Secure context: A static method returning a Promise which resolves to true if an authenticator bound to the platform is capable of verifying the user.

Instance methods

PublicKeyCredential.getClientExtensionResults() Secure context: If any extensions were requested, this method will return the results of processing those extensions.

Examples

Creating a new instance of PublicKeyCredential

Here, we use navigator.credentials.create() to generate a new credential.

const publicKey = {
  challenge: new Uint8Array([
    21, 31, 105 /* 29 more random bytes generated by the server */,
  ]),
  rp: {
    name: "Example CORP",
    id: "login.example.com",
  },
  user: {
    id: new Uint8Array(16),
    name: "canand@example.com",
    displayName: "Carina Anand",
  },
  pubKeyCredParams: [
    {
      type: "public-key",
      alg: -7,
    },
  ],
};

navigator.credentials
  .create({ publicKey })
  .then((newCredentialInfo) => {
    const response = newCredentialInfo.response;
    const clientExtensionsResults =
      newCredentialInfo.getClientExtensionResults();
  })
  .catch((err) => {
    console.error(err);
  });

Getting an existing instance of PublicKeyCredential

Here, we fetch an existing credential from an authenticator, using navigator.credentials.get().

const options = {
  challenge: new Uint8Array([
    /* bytes sent from the server */
  ]),
};

navigator.credentials
  .get({ publicKey: options })
  .then((credentialInfoAssertion) => {
    // send assertion response back to the server
    // to proceed with the control of the credential
  })
  .catch((err) => {
    console.error(err);
  });

Specifications

Specification
Web Authentication: An API for accessing Public Key Credentials - Level 3 # iface-pkcredential

Browser compatibility

BCD tables only load in the browser