Secure context
This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The PublicKeyCredentialCreationOptions
dictionary of the Web Authentication API holds options passed to navigators.credentials.create()
in order to create a PublicKeyCredential
.
Properties
PublicKeyCredentialCreationOptions.rp
- An object describing the relying party which requested the credential creation.
PublicKeyCredentialCreationOptions.user
- An object describing the user account for which the credential is generated.
PublicKeyCredentialCreationOptions.challenge
- A
BufferSource
, emitted by the relying party's server and used as a cryptographic challenge. This value will be signed by the authenticator and the signature will be sent back as part ofAuthenticatorAttestationResponse.attestationObject
. PublicKeyCredentialCreationOptions.pubKeyCredParams
- An
Array
of element which specify the desired features of the credential, including its type and the algorithm used for the cryptographic signature operations. This array is sorted by descending order of preference. PublicKeyCredentialCreationOptions.timeout
Optional- A numerical hint, in milliseconds, which indicates the time the caller is willing to wait for the creation operation to complete. This hint may be overridden by the browser.
PublicKeyCredentialCreationOptions.excludeCredentials
Optional- An
Array
of descriptors for existing credentials. This is provided by the relying party to avoid creating new public key credentials for an existing user who already have some. PublicKeyCredentialCreationOptions.authenticatorSelection
Optional- An object whose properties are criteria used to filter out the potential authenticators for the creation operation.
PublicKeyCredentialCreationOptions.attestation
Optional- A
String
which indicates how the attestation (for the authenticator's origin) should be transported. PublicKeyCredentialCreationOptions.extensions
Optional- An object with several client extensions' inputs. Those extensions are used to request additional processing (e.g. dealing with legacy FIDO APIs credentials, prompting a specific text on the authenticator, etc.).
Methods
None.
Examples
// some examples of COSE algorithms const cose_alg_ECDSA_w_SHA256 = -7; const cose_alg_ECDSA_w_SHA512 = -36; var createCredentialOptions = { // Format of new credentials is publicKey publicKey: { // Relying Party rp: { name: "Example CORP", id: "login.example.com", icon: "https://login.example.com/login.ico" }, // Cryptographic challenge from the server challenge: new Uint8Array(26), // User user: { id: new Uint8Array(16), name: "john.p.smith@example.com", displayName: "John P. Smith", }, // Requested format of new keypair pubKeyCredParams: [{ type: "public-key", alg: cose_alg_ECDSA_w_SHA256, }], // Timeout after 1 minute timeout: 60000, // Do not send the authenticator's origin attestation attestation: "none", extensions: { uvm: true, exts: true }, // Filter out authenticators which are bound to the device authenticatorSelection:{ authenticatorAttachment: "cross-platform", requireResidentKey: true, userVerification: "preferred" }, // Exclude already existing credentials for the user excludeCredentials: [ { type: "public-key", // the id for john.doe@example.com id : new Uint8Array(26) /* this actually is given by the server */ }, { type: "public-key", // the id for john-doe@example.com id : new Uint8Array(26) /* another id */ } ] } }; // Create the new credential with the options above navigator.credentials.create(createCredentialOptions) .then(function (newCredentialInfo) { var attestationResponse = newCredentialInfo.response; var clientExtensionsOutputs = newCredentialInfo.getClientExtensionsResults(); // Send the response to the relying party server // it will verify the content and integrity before // creating a new credential }).catch(function (err) { // Deal with any error properly console.error(err); });;
Specifications
Specification | Status | Comment |
---|---|---|
Web Authentication: An API for accessing Public Key Credentials Level 1 The definition of 'PublicKeyCredentialCreationOptions dictionary' in that specification. |
Recommendation | Initial definition. |
Browser compatibility
The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
PublicKeyCredentialCreationOptions | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera Full support Yes | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android Full support Yes | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
attestation | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
authenticatorSelection | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
challenge | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
excludeCredentials | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
extensions | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
pubKeyCredParams | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
rp | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera Full support Yes | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android Full support Yes | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
timeout | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
user | Chrome Full support 67 | Edge Full support ≤79 | Firefox Full support 60 | IE ? | Opera ? | Safari Full support 13 | WebView Android No support No | Chrome Android Full support 67 | Firefox Android ? | Opera Android ? | Safari iOS Full support 13.3 | Samsung Internet Android No support No |
Legend
- Full support
- Full support
- No support
- No support
- Compatibility unknown
- Compatibility unknown
- Experimental. Expect behavior to change in the future.
- Experimental. Expect behavior to change in the future.
See also
PublicKeyRequestOptions
: the dictionary which provides option for the public key retrieval operation