> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://v3.viem.sh/api/mcp` to find what you need.

# WebAuthn

:::info
`WebAuthn` is a re-export of ox's [`WebAuthn`](https://oxlib.sh/api/WebAuthn). Refer to the ox documentation for the full reference.
:::

Utilities for WebAuthn credentials, credential-bound PRFs, and
[NIST P256](https://csrc.nist.gov/csrc/media/events/workshop-on-elliptic-curve-cryptography-standards/documents/papers/session6-adalier-mehmet.pdf)
signatures.

## Examples

Below are some examples demonstrating common usages of the `WebAuthn` module:

* [Creating Credentials](#creating-credentials)

* [Signing Payloads](#signing-payloads)

* [Verifying Signatures](#verifying-signatures)

### Creating Credentials

Credentials can be created using [`WebAuthn.createCredential`](/docs/utilities/webauthn/createCredential):

```ts twoslash
// @noErrors
import { WebAuthn } from 'viem/utils'

const credential = await WebAuthn.createCredential({
  name: 'Example'
}) // [!code focus]
// @log: {
// @log:   id: 'oZ48...',
// @log:   publicKey: { x: 51421...5123n, y: 12345...6789n },
// @log:   raw: PublicKeyCredential {},
// @log: }

const { metadata, signature } = await WebAuthn.sign({
  credentialId: credential.id,
  challenge: '0xdeadbeef'
})
```

### Signing Payloads

Payloads can be signed using [`WebAuthn.sign`](/docs/utilities/webauthn/sign):

```ts twoslash
// @noErrors
import { WebAuthn } from 'viem/utils'

const credential = await WebAuthn.createCredential({
  name: 'Example'
})

const { metadata, signature } = await WebAuthn.sign({
  // [!code focus]
  credentialId: credential.id, // [!code focus]
  challenge: '0xdeadbeef' // [!code focus]
}) // [!code focus]
// @log: {
// @log:   metadata: {
// @log:     authenticatorData: '0x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d97630500000000',
// @log:     clientDataJSON: '{"type":"webauthn.get","challenge":"9jEFijuhEWrM4SOW-tChJbUEHEP44VcjcJ-Bqo1fTM8","origin":"http://localhost:5173","crossOrigin":false}',
// @log:     challengeIndex: 23,
// @log:     typeIndex: 1,
// @log:     userVerificationRequired: true,
// @log:   },
// @log:   signature: { r: 51231...4215n, s: 12345...6789n },
// @log: }
```

### Verifying Signatures

Signatures can be verified using [`WebAuthn.verify`](/docs/utilities/webauthn/verify):

```ts twoslash
// @noErrors
import { WebAuthn } from 'viem/utils'

const credential = await WebAuthn.createCredential({
  name: 'Example'
})

const { metadata, signature } = await WebAuthn.sign({
  credentialId: credential.id,
  challenge: '0xdeadbeef'
})

const result = await WebAuthn.verify({
  // [!code focus]
  metadata, // [!code focus]
  challenge: '0xdeadbeef', // [!code focus]
  publicKey: credential.publicKey, // [!code focus]
  signature // [!code focus]
}) // [!code focus]
// @log: true
```

## Functions

| Name                | Description                         |
| ------------------- | ----------------------------------- |
| [`WebAuthn.createCredential`](/docs/utilities/webauthn/createCredential) | Creates a WebAuthn credential and optionally returns its credential-bound PRF output. |
| [`WebAuthn.getCredential`](/docs/utilities/webauthn/getCredential) | Requests a WebAuthn credential and returns its credential-bound PRF output. |
| [`WebAuthn.sign`](/docs/utilities/webauthn/sign) | Signs a challenge using a stored WebAuthn P256 Credential. If no Credential is provided, a prompt will be displayed for the user to select an existing Credential that was previously registered. |
| [`WebAuthn.verify`](/docs/utilities/webauthn/verify) | Verifies a signature using the Credential's public key and the challenge which was signed. |

## Errors

| Name                | Description                         |
| ------------------- | ----------------------------------- |
| [`WebAuthn.GetCredentialFailedError`](/docs/utilities/webauthn/errors#webauthngetcredentialfailederror) | Thrown when a WebAuthn credential request fails. |
| [`WebAuthn.InvalidExtensionError`](/docs/utilities/webauthn/errors#webauthninvalidextensionerror) | Thrown when a caller supplies the managed `prf` extension. |
| [`WebAuthn.InvalidOptionsError`](/docs/utilities/webauthn/errors#webauthninvalidoptionserror) | Thrown when raw credential options are combined with managed PRF evaluation. |
| [`WebAuthn.InvalidPrfOutputError`](/docs/utilities/webauthn/errors#webauthninvalidprfoutputerror) | Thrown when a WebAuthn PRF result is not a valid 32-byte output. |
| [`WebAuthn.PrfEvaluationFailedError`](/docs/utilities/webauthn/errors#webauthnprfevaluationfailederror) | Thrown when WebAuthn PRF evaluation fails after a credential ceremony. |
| [`WebAuthn.PrfNotSupportedError`](/docs/utilities/webauthn/errors#webauthnprfnotsupportederror) | Thrown when a created credential does not support PRF evaluation. |
| [`WebAuthn.PrfUnavailableError`](/docs/utilities/webauthn/errors#webauthnprfunavailableerror) | Thrown when a credential assertion does not return a PRF output. |

## Types

| Name                | Description                         |
| ------------------- | ----------------------------------- |
| [`WebAuthn.AttestationConveyancePreference`](/docs/utilities/webauthn/types#webauthnattestationconveyancepreference) |  |
| [`WebAuthn.AuthenticatorAttachment`](/docs/utilities/webauthn/types#webauthnauthenticatorattachment) |  |
| [`WebAuthn.AuthenticatorTransport`](/docs/utilities/webauthn/types#webauthnauthenticatortransport) |  |
| [`WebAuthn.BufferSource`](/docs/utilities/webauthn/types#webauthnbuffersource) |  |
| [`WebAuthn.COSEAlgorithmIdentifier`](/docs/utilities/webauthn/types#webauthncosealgorithmidentifier) |  |
| [`WebAuthn.CredentialMediationRequirement`](/docs/utilities/webauthn/types#webauthncredentialmediationrequirement) |  |
| [`WebAuthn.LargeBlobSupport`](/docs/utilities/webauthn/types#webauthnlargeblobsupport) |  |
| [`WebAuthn.P256Credential`](/docs/utilities/webauthn/types#webauthnp256credential) | A WebAuthn-flavored P256 credential. |
| [`WebAuthn.Prf`](/docs/utilities/webauthn/types#webauthnprf) | Configuration for evaluating a WebAuthn credential-bound PRF. |
| [`WebAuthn.PrfExtension`](/docs/utilities/webauthn/types#webauthnprfextension) | Inputs for the WebAuthn PRF extension. |
| [`WebAuthn.PublicKeyCredential`](/docs/utilities/webauthn/types#webauthnpublickeycredential) |  |
| [`WebAuthn.PublicKeyCredentialType`](/docs/utilities/webauthn/types#webauthnpublickeycredentialtype) |  |
| [`WebAuthn.ResidentKeyRequirement`](/docs/utilities/webauthn/types#webauthnresidentkeyrequirement) |  |
| [`WebAuthn.SignMetadata`](/docs/utilities/webauthn/types#webauthnsignmetadata) | Metadata for a WebAuthn P256 signature. |
| [`WebAuthn.UserVerificationRequirement`](/docs/utilities/webauthn/types#webauthnuserverificationrequirement) |  |