Skip to main content

Interface: PasskeyConfig

Defined in: src/auth/types.ts:28

Configuration for a WebAuthn/Passkey relying party.

Properties​

authenticatorAttachment?​

optional authenticatorAttachment?: "cross-platform" | "platform"

Defined in: src/auth/types.ts:57

Restricts which category of authenticator may be used to create a new credential during registration. Set to "cross-platform" to steer users toward roaming/hardware security keys (e.g. a YubiKey), or "platform" for built-in authenticators (Face ID, Windows Hello, etc). Leave unset to allow either — the appropriate default for passkey registration.

origin​

origin: string | string[]

Defined in: src/auth/types.ts:37

The exact scheme+host+port expected in the client's clientDataJSON.origin (e.g. "https://example.com"). May be a list to support multiple valid frontend origins.

requireUserVerification?​

optional requireUserVerification?: boolean

Defined in: src/auth/types.ts:48

Whether user verification is enforced at response-verification time. This is a distinct knob from userVerification above (which only shapes what's requested from the client). Default is true.

residentKey?​

optional residentKey?: "discouraged" | "preferred" | "required"

Defined in: src/auth/types.ts:63

Whether a newly registered credential must be discoverable (usable in a "usernameless" flow). Default is "preferred". A hardware security key used purely as a known-account credential typically doesn't need this and can use "discouraged".

rpID​

rpID: string

Defined in: src/auth/types.ts:32

The relying party ID — a valid domain name (no scheme/port), e.g. "example.com".

rpName​

rpName: string

Defined in: src/auth/types.ts:30

The human-readable name of the relying party, shown to the user by the authenticator UI.

timeout?​

optional timeout?: number

Defined in: src/auth/types.ts:50

How long (in ms) the user has to complete the ceremony. Default is 60000.

userVerification?​

optional userVerification?: "discouraged" | "preferred" | "required"

Defined in: src/auth/types.ts:42

Requested user verification behavior at options-generation time. Set to "discouraged" for a 2FA-style flow, "required"/"preferred" otherwise. Default is "preferred".