[API reference](https://evolu.dev/docs/api-reference) › [@evolu/web](https://evolu.dev/docs/api-reference/web) › createPasskeyKeyProvider

```ts
function createPasskeyKeyProvider(
  __namedParameters: CreatePasskeyKeyProviderOptions,
): DeviceSecretKeyProvider;
```

Defined in: [packages/web/src/local-first/Passkey.ts:426](https://github.com/evoluhq/evolu/blob/aa223771feea747ffb1b0f5f3271574455633e37/packages/web/src/local-first/Passkey.ts#L426)

Creates a [DeviceSecretKeyProvider](https://evolu.dev/docs/api-reference/common/local-first/Auth/interfaces/DeviceSecretKeyProvider) whose keys are passkeys of the
current site and their WebAuthn PRF outputs. Pass it to
[unlockWrappedDeviceSecret](https://evolu.dev/docs/api-reference/common/local-first/Evolu/functions/unlockWrappedDeviceSecret).

Creating a key registers a discoverable passkey with user verification and a
fresh random user handle, so registrations don't replace each other, and
requests PRF, which security keys enable only at registration. Getting a key
evaluates a fixed, versioned PRF input with user verification. Creating a key
evaluates none, because a provider can support PRF at registration and not
later, so `unlockWrappedDeviceSecret` gets a new key with a second prompt,
which proves that unlocking works before it stores a secret. PRF support
varies with the browser and the passkey provider, and some report no PRF at
registration but provide it when getting the key, as Samsung Pass does, so
creating a key ignores what registration reports, and getting the key of a
passkey without PRF fails with `DeviceSecretKeyUnavailable`. A refusal,
`DeviceSecretKeyRefused`, can mean the user dismissed the prompt, the passkey
is gone, the provider refuses PRF, as Microsoft Password Manager does, or a
password manager's browser extension took the request over while locked and
the user closed its prompt. Let the user try again, and offer to start over
with [forgetWrappedDeviceSecret](https://evolu.dev/docs/api-reference/common/local-first/Evolu/functions/forgetWrappedDeviceSecret), as `unlockWrappedDeviceSecret`
describes.

Safari may require each WebAuthn request to start in a user gesture, such as
a button click. Safari returns a different PRF output from other browsers for
the same USB or NFC security key; see [WebKit bug
311099](https://bugs.webkit.org/show_bug.cgi?id=311099).