WebAuthn Server Options: Overview of Early Adopters

More and more organizations recognize the benefits of passkeys, so the implementation of WebAuthn servers has become a critical component of their authentication strategies.

This article explores the WebAuthn server options, particularly focusing on PublicKeyCredentialCreationOptions and PublicKeyCredentialRequestOptions. By understanding how large tech companies like Google, Binance or Revolut have implemented WebAuthn server, developers and product managers can better learn from these best practices for their own passkey integrations.

To effectively implement passkeys, it’s essential to grasp the core WebAuthn server options:

• PublicKeyCredentialCreationOptions: These options are crucial for credential creation during the setup of passkeys (read more).
• PublicKeyCredentialRequestOptions: These options come into play during the authentication process, defining the parameters for assertion generation (read more).

In the following table, you find an overview of best practices of large tech companies on how they have defined their PublicKeyCredentialCreationOptions.

In the following table, you find an overview of best practices of large tech companies on how they have defined their PublicKeyCredentialRequestOptions.

For those looking to implement WebAuthn servers and use passkeys in the most user-friendly and secure way, we recommend the following WebAuthn server configurations:

PublicKeyCredentialCreationOptions

• Relying Party

  • Reying Party ID: Use your root domain in order to be able to make the passkey reusable in potential future sub-domains as well (read mode).
  • Relying Party Name: Use the name your product / service is known to your users.

• User

  • User Display Name: Firstname + Lastname (read more)
  • User ID: Use your internal user ID (read more)
  • User Name: Use the nam how you want to address your users (read more)
  • pubKeyCredParams: Use at least the following two algorithms (read more)
  • ES256 (alg: -7, type: public-key)
  • RS256 (alg: -257, type: public-key)

• authenticatorSelection (read more):

  • residentKey: required (read more)
  • userVerification: required – Make sure you understand the Flags & check UV flag in case you rely on it (read more)

• attestation: direct - so that you can get the AAGUID of uses authenticators and improve the UX (read more)

• Extension: none

PublicKeyCredentialRequestOptions

• userVerification: required

In summary, leading tech companies like Google, Microsoft, eBay, and GitHub have successfully implemented passkeys. Make use of common patterns regarding the WebAuthn server options to ensure highest security and UX standards. This can significantly optimize your passkey implementation.