WebAuthn (Web Authentication) is a W3C standard and browser API that lets web applications register and authenticate users with public-key credentials instead of passwords. It’s the web-facing half of FIDO2, the interface that makes passkeys and security-key login possible in the browser.

If FIDO2 is the framework, WebAuthn is the part websites actually call. When a site offers "sign in with a passkey," WebAuthn is the API doing the work behind that button.

How WebAuthn works

WebAuthn defines two ceremonies:

• Registration: the site asks the browser to create a credential; the authenticator (device or security key) generates a key pair, keeps the private key, and returns the public key to the site.
• Authentication, the site sends a challenge; the authenticator signs it with the private key after the user consents (biometric or PIN); the site verifies the signature against the stored public key.

Crucially, WebAuthn binds each credential to the site’s origin, which is the mechanism that makes it phishing-resistant, the browser won’t use a credential on the wrong domain.

WebAuthn, CTAP, and passkeys

WebAuthn handles the browser-to-server side; CTAP handles the browser-to-authenticator side (for example, using a phone or security key to authenticate on a laptop). Passkeys are the credentials created and used through WebAuthn, with platform sync added. For developers, WebAuthn is the standard to integrate against, though platforms and CIAM providers typically wrap it in SDKs so teams don’t implement the ceremonies from scratch.

WebAuthn in practice for developers

Implementing WebAuthn directly means handling the registration and authentication ceremonies, managing the challenge/response exchange, storing public keys, and dealing with browser and platform quirks across the ecosystem. It’s well-specified but detailed, and edge cases (cross-device flows, multiple authenticators per user, recovery) add work. This is why most teams integrate WebAuthn through a CIAM platform or SDK rather than building it from scratch: the platform abstracts the ceremonies and, importantly, wraps the standard with the lifecycle pieces WebAuthn itself doesn’t define: enrollment UX, account recovery, fallback, and the risk decisioning that decides when a fallback is safe. WebAuthn gives you the phishing-resistant primitive; a platform turns it into a production login.

Frequently asked questions

What is WebAuthn used for?

Passwordless, phishing-resistant authentication in web browsers, using passkeys or security keys.

Is WebAuthn the same as FIDO2?

WebAuthn is the web API component of FIDO2; CTAP is the other component.

Does WebAuthn stop phishing?

Yes, credentials are bound to the site’s origin, so they can’t be used on a fake domain.

Related: FIDO2 · CTAP · Passkeys · Passwordless Authentication · Biometric Authentication