DOCSEARCHbyAlgolia
Submit Docs

Passwordless.dev Documentation

website·Indexed 33 days ago

https://docs.passwordless.dev

A software toolkit by Bitwarden that empowers developers to build applications with phish-proof authentication using FIDO2 and WebAuthn passkeys. Includes SDKs for JavaScript, React, Android, and iOS, as well as backend implementations for Node.js, Python, Java, PHP, and ASP.NET Core.

Tokens
19.4K
Snippets
88
Records
123
Agent score
64%

What's inside Passwordless.dev

  1. Overview of Bitwarden Passwordless.dev

    Bitwarden Passwordless.dev is an open-source software toolkit that enables developers to integrate FIDO2 WebAuthn-based passkey authentication into websites and enterprise applications. It abstracts the complexity of W3C specifications, cryptography implementation, and public key management, providing a simplified wrapper for passkey authentication flows.

  2. Structure a Passwordless.dev SDK README

    To provide a good developer experience, the SDK's README should include the following sections:

    • Introduction: State if the project is community-led, link to the official documentation (https://docs.passwordless.dev), and link to the admin portal (https://admin.passwordless.dev).
    • Installation: Clear instructions on how to install and set up the SDK.
    • Getting Started: A basic usage example to get users up and running.
    • API Reference: Documentation for the SDK methods that wrap the Passwordless API.
    • Examples: A simple application demonstrating how to create and verify a passkey.

  3. Access and use the Passwordless Admin Console

    The Admin Console is the primary graphical user interface (GUI) used to create and configure applications, monitor application usage, and manage billing. It is accessible at https://admin.passwordless.dev/. After creating a new application, users can manage Applications, Billing, and Admins through the console's navigation.

  4. Understand the Passwordless.dev architecture

    The Passwordless.dev system is composed of three primary components that handle the authentication lifecycle:

    1. Client-side Library: Integrated into the frontend to interact with the browser's WebAuthn API and communicate with Passwordless.dev APIs.
    2. Public RESTful API: Facilitates the FIDO2 WebAuthn cryptographic exchanges between the client-side library and the browser.
    3. Private RESTful API: Used by the application backend to initiate key registrations, verify user sign-ins, and retrieve user keys.

  5. Integrate Passwordless.dev with backend languages

    Passwordless.dev can be integrated into any programming language by making direct calls to the Passwordless.dev API. Official integration guides are available for ASP .NET Core, Java, Node.js, PHP, Python 2, and Python 3. Additionally, community-developed (unofficial) SDKs exist for Rust, Go, and Java Spring Boot.

  6. Understand Passwordless.dev Product Architecture

    The product consists of three primary components:

    1. Client-side Library: An open-source library used by the frontend to interact with the browser's WebAuthn API and the Passwordless.dev APIs.
    2. Public RESTful API: Used by the frontend to complete FIDO2 WebAuthn cryptographic exchanges.
    3. Private RESTful API: Used by the backend to initiate key registrations, verify sign-ins, and retrieve user keys.

  7. Configure WebAuthn Attestation levels

    Attestation allows a relying party to verify information about the authenticator used during registration. Support varies by plan:

    • none (All Plans): Provides attestation info without a cryptographic signature. Used when strong proof of authenticator characteristics is not required.
    • direct (Enterprise Plan): Also known as 'self-attestation'. The authenticator makes a statement about its own properties without a third-party certificate.
    • indirect (Enterprise Plan): Includes a signed statement from an Attestation Certificate Authority (AttCA), providing cryptographic proof of the device's characteristics.
    • enterprise: Allows enterprises to uniquely identify and approve specific authenticators for protected environments.

  8. Understand FIDO2, WebAuthn, and CTAP2 standards

    Passwordless.dev is built on FIDO2, a W3C standard for secure web authentication. It consists of two main components:

    • WebAuthn: An API that connects a relying party (the server) to an application or login system, enabling passwordless authentication between the web and the application.
    • CTAP2 (Client to Authenticator Protocol): Allows external, portable authenticators (like USB security keys) to communicate with a client platform and website.

  9. Implement FIDO2 WebAuthn passkeys with Bitwarden Passwordless.dev

    Bitwarden Passwordless.dev allows developers to create phish-proof authentication experiences using open source and modern browser standards. It supports FIDO2 WebAuthn applications, enabling users to authenticate via Face ID, fingerprints, and Windows Hello.

  10. Use Passkeys and Discoverable Credentials

    Passkeys are discoverable FIDO credentials that replace passwords. They can be synced across devices or bound to a single piece of hardware. Because they are 'Discoverable Credentials,' they allow authentication without the server requiring a credentialId first, meaning users can sign in without first providing a username or email.

  11. Implement Passkey Sign-in via Auto Fill

    Auto Fill allows users to sign in by selecting a passkey from the keyboard suggestions. To enable this, call signInWithAutofill() when the view first appears so the OS can prepare the results before the keyboard is shown.

    Behavior:

    • The function waits until the user selects an item, cancels the dialog, or an error occurs.
    • If authorizationCancelled is thrown, it is generally safe to restart the process.
    • If authorizationError is thrown, check your app configuration to avoid infinite error loops.
    let verifyToken = try await passwordlessClient.signInWithAutofill()

  12. Verify a login token using verifyToken

    Verify a token provided by the client using the verifyToken method. If the returned VerifiedUser object has success === true, the token is valid and the user is authenticated.
    signin = async (request: express.Request, response: express.Response) => {
  try {
    const token: string = request.query.token as string;

    // Verify the token and check if a matching user is found
    const verifiedUser: VerifiedUser = await this._passwordlessClient.verifyToken(token);

    if (verifiedUser && verifiedUser.success === true) {
      response.send(JSON.stringify(verifiedUser));
      return;
    }
  } catch (error) {
    console.error(error.message);
  }
  response.send(401);
};