All IAM glossary termsProtocols · glossary

WebAuthn

Also known as: Web Authentication · Web Authentication API

Definition

WebAuthn is the W3C standard browser API for FIDO2-based public-key authentication, exposing `navigator.credentials.create()` and `navigator.credentials.get()` to web applications.

In more depth

WebAuthn (Web Authentication) is one half of FIDO2 (the other half is CTAP2, which runs between the browser and authenticator). Developers interact with WebAuthn through the `PublicKeyCredential` interface — registering a credential during signup, then later requesting an assertion during login.

Under the hood, WebAuthn binds credentials to the relying-party origin (the website's domain). This origin binding is what makes WebAuthn phishing-resistant: a credential created for `bank.com` cannot be used against `bank-phish.com`, even if the user is fooled.

Related terms

Want the work, not just the definition?

We staff + deliver across IAM.

Talk to a practice leadMore glossary terms