Web Authentication API: Resident Keys

Security

Security keys are generally stateless save for a global signature counter. While it’s technically possible to implement a stateful security key, physical tokens generally encrypt their state in a credential ID that is stored on the server of the relying party. Resident keys allow the security key to keep state and thus allow a username-less login experience by just proving a local PIN to the device. Developers can exercise this via the existing Webauthn standard.

Specification

Established standard

Status in Chromium

Blink>WebAuthentication


Behind a flag (tracking bug) in:

  • Chrome for desktop release 76

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • No public signals
  • Shipped
  • No public signals
  • No signals

Owners

Last updated on 2019-05-03