passkey/api-methods

11 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

addPasskey API method parameters

The addPasskey client method accepts the following parameters: name (optional, string, defaults to user email or ID), authenticatorAttachment (optional, 'platform' or 'cross-platform', defaults to allowing both), extensions (optional, WebAuthn extension inputs), returnWebAuthnResponse (optional, boolean, returns WebAuthn response and extension results), context (optional, string, for passkey-first registration flows).

signIn.passkey API method parameters

The signIn.passkey client method accepts the following parameters: autoFill (optional, boolean, defaults to true, enables browser autofill/Conditional UI), extensions (optional, WebAuthn extension inputs), returnWebAuthnResponse (optional, boolean, returns WebAuthn response and extension results).

listUserPasskeys API method

Call passkey.listUserPasskeys() to retrieve all passkeys for the authenticated user. This is a GET request to /passkey/list-user-passkeys that requires a session. Each passkey includes an aaguid field containing the authenticator model identifier.

deletePasskey API method parameters

The deletePasskey client method requires a session and accepts one parameter: id (string, required, the ID of the passkey to delete). POST request to /passkey/delete-passkey.

updatePasskey API method parameters

The updatePasskey client method requires a session and accepts the following parameters: id (string, required, the ID of the passkey to update), name (string, required, the new name for the passkey). POST request to /passkey/update-passkey.

Authenticator naming with getAuthenticatorName

The @better-auth/passkey package exports getAuthenticatorName() function that resolves an aaguid to a friendly authenticator name. It uses a built-in list of common authenticators. A passkey's name field takes precedence over the AAGUID-resolved name. For comprehensive coverage, extend the lookup using the exported commonAuthenticatorNames map or reference the community-maintained passkeydeveloper/passkey-authenticator-aaguids repository.

Passkey WebAuthn extensions return

When returnWebAuthnResponse is set to true in addPasskey or signIn.passkey, the response includes a webauthn property containing clientExtensionResults from the WebAuthn call.

Passkey error handling in fetch options

Setting throw: true in the fetch options has no effect for passkey register and sign-in responses. They always return a data object containing an error object instead of throwing.

Example: Get authenticator name for passkeys

Example of listing passkeys and resolving authenticator names: import { getAuthenticatorName } from "@better-auth/passkey"; const passkeys = await authClient.passkey.listUserPasskeys(); for (const passkey of passkeys.data ?? []) { const label = passkey.name || getAuthenticatorName(passkey.aaguid) || "Passkey"; }

Example: Extend authenticator names map

Example of extending the built-in authenticator names: import { commonAuthenticatorNames } from "@better-auth/passkey"; const names = { ...commonAuthenticatorNames, "your-aaguid": "Your Provider" };

Example: WebAuthn extensions with passkey

Example of using WebAuthn extensions and returning the WebAuthn response: const result = await authClient.passkey.addPasskey({ name: "My Passkey", extensions: { credProps: true, }, returnWebAuthnResponse: true, }); console.log(result.webauthn?.clientExtensionResults);

Give your agent this brain