DOCSEARCHbyAlgolia
Submit Docs

Passwordless.dev Documentation

website·Indexed 30 days ago

https://fix-api-key.passwordless-docs.pages.dev/

A software toolkit by Bitwarden that enables developers to build applications with FIDO2 WebAuthn and passkey authentication. Includes client SDKs for Android, iOS, JavaScript, and React, as well as backend implementations for Java, Node.js, Python, PHP, and ASP.NET Core. Features an Admin Console for application management and options for enterprise self-hosting via Docker.

Tokens
20.1K
Snippets
93
Records
138
Agent score
75%

What's inside Passwordless.dev

  1. Overview of Passwordless.dev passkey toolkit

    Passwordless.dev is an open-source software toolkit developed by Bitwarden that allows developers to integrate FIDO2 WebAuthn-based passkey authentication into websites and enterprise applications. It abstracts the complexity of W3C specifications, cryptography implementation, and public key management, providing a simplified wrapper for passkey authentication flows.

  2. Configure WebAuthn Attestation levels

    Attestation allows a relying party to verify information about the authenticator to enhance security. Note: Direct and Indirect attestation are only supported on the 'Enterprise' plan.

    TypePlanDescription
    noneAllAuthenticator provides info without a cryptographic signature. Used when strong proof of characteristics is not required.
    directEnterpriseAlso known as 'self-attestation'. The authenticator makes a statement about its own properties without a third-party certificate.
    indirectEnterpriseIncludes a signed statement from an Attestation Certificate Authority (AttCA), providing cryptographic proof of characteristics.
    enterpriseN/AAllows enterprises to uniquely identify and approve specific authenticators for protected environments.

  3. Implement FIDO2 WebAuthn authentication with Bitwarden Passwordless.dev

    Bitwarden Passwordless.dev allows developers to create FIDO2 WebAuthn applications, enabling users to authenticate using biometric and hardware-based methods such as Face ID, fingerprint scanners, and Windows Hello. The service is built on open-source and modern browser standards to ensure phish-proof security.

  4. Understand the Passwordless.dev architecture

    The Passwordless.dev architecture is composed of three primary components that handle the authentication flow between the end-user's browser, the frontend, and the backend:

    1. Client-side Library: Integrated into the frontend to interact with the browser's WebAuthn API and communicate with Passwordless.dev APIs.
    2. Public RESTful API: Used by the client-side library to perform FIDO2 WebAuthn cryptographic exchanges with the browser.
    3. Private RESTful API: Used by the application backend to initiate key registrations, verify user sign-ins, and retrieve user keys.

  5. Understand FIDO2, WebAuthn, and CTAP2 in Passwordless.dev

    Passwordless.dev implements the FIDO2 standard for secure, passwordless authentication. FIDO2 consists of two primary components:

    1. WebAuthn: An API that connects a relying party (the server) to an application or login system, enabling the web browser to communicate with an authenticator.
    2. CTAP2 (Client to Authenticator Protocol): Allows external, portable authenticators (like USB security keys) to communicate with a client platform/browser.

    Together, these standards replace passwords and SMS 2FA with more secure cryptographic authentication.

  8. Understand Passwordless.dev Product Architecture

    The product consists of three main components:

    1. Client-side Library: An open-source JS library used by the frontend to interact with the browser's WebAuthn API and the Passwordless.dev APIs.
    2. Public RESTful API: Used by the frontend to complete FIDO2 WebAuthn cryptographic exchanges.
    3. Private RESTful API: Used by the backend to initiate key registrations, verify sign-ins, and retrieve user keys.

  9. Structure documentation for a Passwordless.dev SDK

    To provide a high-quality developer experience, the SDK's README should include the following sections:

    • Introduction: State that it is a community project and provide links to the official documentation (https://docs.passwordless.dev) and the admin portal (https://admin.passwordless.dev).
    • Installation: Clear instructions on how to install and set up the SDK.
    • Getting Started: A basic usage example to get users up and running quickly.
    • API Reference: Documentation for the SDK methods that wrap the Passwordless API.
    • Examples: A simple application demonstrating core flows, specifically creating and verifying a passkey.

  10. Use Passkeys and Discoverable Credentials

    Passkeys are discoverable FIDO credentials that can be synced across a user's devices or bound to a single piece of hardware. Because they are 'Discoverable Credentials,' they can be used for authentication without the server requiring a credentialId first, meaning users can sign in without first providing a username or email.

  11. Retrieve system emails from the self-hosted instance

    By default, the self-hosted system appends outgoing emails (such as organization invites) to local files instead of sending them via a mail provider. You can read these files using the following commands.
    # Admin Console emails
docker exec -it {name-of-container} cat /app/AdminConsole/mail.md

# API emails
docker exec -it {name-of-container} cat /app/Api/mail.md