Passkeys’ Public Keys

Public key is only available during generation

Last updated - Tue Jul 18 2023

Back to caveats_

Although part of the Passkey information is provided as part of the "signing" or "attestation" process of the Webauthn workflow, the actual public key is NOT included in the response. The attestation includes a signature over the clientDataJSON and the authenticatorData, the latter including some information about the actual device used during the verification process. However, the public key data is only available during the registration part of the Webauthn workflow (i.e., the navigator.credentials.create call) and is not available to that particular Passkey anymore, not even during the navigator.credentials.get call.

To access a Passkey public key, you need to await for the response payload, and call the method response.getPublicKey(). Within TypeScript, you can cast the response of the credential as AuthenticatorAttestationResponse to have visibility of the getPublicKey method.

Back to caveats_

By 0xjjpa.

MIT License'd code available in GitHub.

Last updated - Sun Oct 08 2023