CRATEFIELD
Join the waitlist

/technology/modules/ · auth-passkeys Shipping

auth-passkeys

WebAuthn registration and login, verified in pure Rust. No password to phish, and no account left without a way in.

crates/auth-passkeys By Factory Zero

What it is

auth-passkeys.

A passkey is registered against a signed-in session and used to log in without one. The registration options carry the relying party, the user handle, the algorithms accepted and the credentials to exclude; login options carry a challenge, and with an email the account's credential ids, otherwise an empty list so a discoverable credential can answer.

The rule worth naming is on the delete route: a passkey cannot be removed when it is the account's only way in. An account with no credential left is not a tidier account, it is a locked-out person with a support ticket.

Crate

factory0-auth-passkeys · in the repo, not yet on crates.io. MIT.

Ports

Database · Clock · IdGen · Signer

Routes

  • POST /v1/auth-passkeys/register/options — session required — a challenge, the RP, the user handle, the algorithms and the credentials to exclude
  • POST /v1/auth-passkeys/register/verify — session required — checks the ceremony and stores the credential
  • POST /v1/auth-passkeys/login/options — public — a challenge; with an email, the account's credential ids
  • POST /v1/auth-passkeys/login/verify — public — checks the assertion, advances the counter, issues a session
  • GET /v1/auth-passkeys/credentials — session required — the account's passkeys
  • DELETE /v1/auth-passkeys/credentials/{id} — session required — removes one, unless it is the only way in

Google arrives over OpenID Connect in auth-oidc. Apple, Meta, password and magic links are separate crates.

Join the waitlist All modules