This section describes the status of this document at the time of its publication. Other
documents may supersede this document. A list of current
W3C publications and the latest revision of this
technical report can be found in the
W3C technical
reports index at https://www.w3.org/TR/.
This document was published by the Web Authentication Working Group
as a Recommendation.
Feedback and comments on this specification are welcome. Please use
Github issues.
Discussions may also be found in the
public-webauthn@w3.org archives.
A W3C Recommendation is a specification that, after extensive consensus-building, has received the endorsement of the W3C and its Members. W3C recommends the wide deployment of this specification as a standard for the Web.
This document has been reviewed by W3C Members, by
software developers, and by other W3C groups and
interested parties, and is endorsed by the Director as a
W3C Recommendation. It is a stable document and may be
used as reference material or cited from another
document. W3C's role in making the Recommendation is to
draw attention to the specification and to promote its
widespread deployment. This enhances the functionality
and interoperability of the Web.
This document was produced by a group operating under the
1 August 2017
W3C Patent Policy.
W3C maintains a
public list of any
patent disclosures made in connection with the deliverables of the group; that page also
includes instructions for disclosing a patent. An individual who has actual knowledge of a
patent which the individual believes contains
Essential
Claim(s) must disclose the information in accordance with
section 6 of the
W3C Patent Policy.
This document is governed by the 15 September 2020 W3C Process Document.
1. Introduction
This section is not normative.
This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based
credentials by web applications, for the purpose of strongly authenticating users. A public key credential is
created and stored by a WebAuthn Authenticator at the behest of a WebAuthn Relying Party, subject to user
consent. Subsequently, the public key credential can only be accessed by origins belonging to that Relying Party.
This scoping is enforced jointly by conforming User Agents and authenticators.
Additionally, privacy across Relying Parties is maintained; Relying Parties are not able to detect any properties, or even
the existence, of credentials scoped to other Relying Parties.
Relying Parties employ the Web Authentication API during two distinct, but related, ceremonies involving a user. The first
is Registration, where a public key credential is created on an authenticator, and scoped to a