API reference › @evolu/web › createPasskeyKeyProvider

function createPasskeyKeyProvider(
  __namedParameters: CreatePasskeyKeyProviderOptions,
): DeviceSecretKeyProvider;

Defined in: packages/web/src/local-first/Passkey.ts:426

Creates a DeviceSecretKeyProvider whose keys are passkeys of the current site and their WebAuthn PRF outputs. Pass it to unlockWrappedDeviceSecret.

Creating a key registers a discoverable passkey with user verification and a fresh random user handle, so registrations don't replace each other, and requests PRF, which security keys enable only at registration. Getting a key evaluates a fixed, versioned PRF input with user verification. Creating a key evaluates none, because a provider can support PRF at registration and not later, so unlockWrappedDeviceSecret gets a new key with a second prompt, which proves that unlocking works before it stores a secret. PRF support varies with the browser and the passkey provider, and some report no PRF at registration but provide it when getting the key, as Samsung Pass does, so creating a key ignores what registration reports, and getting the key of a passkey without PRF fails with DeviceSecretKeyUnavailable. A refusal, DeviceSecretKeyRefused, can mean the user dismissed the prompt, the passkey is gone, the provider refuses PRF, as Microsoft Password Manager does, or a password manager's browser extension took the request over while locked and the user closed its prompt. Let the user try again, and offer to start over with forgetWrappedDeviceSecret, as unlockWrappedDeviceSecret describes.

Safari may require each WebAuthn request to start in a user gesture, such as a button click. Safari returns a different PRF output from other browsers for the same USB or NFC security key; see WebKit bug 311099.