Passkeys 2: registration ceremony #38

New Issue

2026-08-17T17:14:06-05:00

bermudalamb commented

2026-08-17 17:14:06 -05:00

Part of the Passkeys project. Parent: #36. Depends on the schema/config groundwork.

Scope

A signed-in customer can register a passkey on their current device.

POST /api/customers/me/passkeys/register/begin — issues registration options with a server-generated challenge
POST /api/customers/me/passkeys/register/finish — verifies the attestation and stores the credential

Requirements

The challenge must be server-generated, single-use, and expiring. A replayable challenge defeats the point of the ceremony.
Registration requires an authenticated session — this is not a sign-up path.
Already-registered credential IDs must be excluded so the same authenticator cannot be enrolled twice.
The customer names the passkey, or it gets a sensible default, so the management UI can distinguish "phone" from "laptop".

Out of scope

Signing in with the passkey, and the management UI — separate issues.

Part of the Passkeys project. Parent: #36. Depends on the schema/config groundwork. ## Scope A signed-in customer can register a passkey on their current device. - `POST /api/customers/me/passkeys/register/begin` — issues registration options with a server-generated challenge - `POST /api/customers/me/passkeys/register/finish` — verifies the attestation and stores the credential ## Requirements - The challenge must be server-generated, single-use, and expiring. A replayable challenge defeats the point of the ceremony. - Registration requires an authenticated session — this is not a sign-up path. - Already-registered credential IDs must be excluded so the same authenticator cannot be enrolled twice. - The customer names the passkey, or it gets a sensible default, so the management UI can distinguish "phone" from "laptop". ## Out of scope Signing in with the passkey, and the management UI — separate issues.

bermudalamb referenced this issue

2026-08-17 17:16:07 -05:00

Passkey (WebAuthn) login for customers #36

bermudalamb added this to the Passkey Implementation project 2026-08-17 17:21:30 -05:00

bermudalamb self-assigned this 2026-08-21 16:09:53 -05:00

bermudalamb referenced this issue from a commit

2026-09-09 14:16:02 -05:00

feat(passkeys): registration ceremony (#38)

bermudalamb referenced a pull request that will close this issue

2026-09-09 14:16:17 -05:00

feat(passkeys): registration ceremony (#38) #331

bermudalamb referenced this issue