WebAuthn
A W3C authentication API that enables origin-bound public-key credentials such as passkeys and hardware authenticators in web applications.
Security Context
WebAuthn is the browser-facing public-key authentication API behind passkeys and hardware authenticators. Relying Party ID and origin binding are central to its phishing resistance because credentials are scoped to the intended web origin rather than presented as a reusable secret.
Lifecycle Boundary
WebAuthn does not solve account enrollment, device loss, or recovery policy by itself. Those flows create their own attack surface and must be designed separately.
Related Security Concepts
- Passkey
- Public Key Infrastructure
- Authentication
- Phishing Resistance