passkey/configuration

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Passkey-first registration configuration

To enable passkey-first onboarding without requiring a session, set registration.requireSession to false in the passkey plugin config. When false, you must provide a resolveUser function to validate context (e.g., a signed token) and create or load a user. The function receives ctx and context parameters and must return an object with id and name properties.

Passkey registration with context

When passkey-first registration is enabled (registration.requireSession: false), call auth.api.generatePasskeyRegistrationOptions({ context: "signed-registration-token" }) to get registration options without a session. Pass the same context when calling authClient.passkey.addPasskey({ name: "Primary passkey", context: "signed-registration-token" }) so the server can resolve the user during verification.

Passkey extensions configuration

The passkey plugin accepts optional WebAuthn extensions in two locations: registration.extensions and authentication.extensions. Both accept extension configurations like { credProps: true }. These can be overridden per-request through the client API.

Passkey afterVerification hook for default naming

In the passkey registration config, use the afterVerification hook to set a default passkey name based on the authenticator. The hook receives a verification object containing verification.registrationInfo.aaguid. Return an object with a name property. Client-supplied names always take precedence over server-set defaults.

Example: Set default passkey name from authenticator AAGUID

Example of setting a default passkey name based on AAGUID in the afterVerification hook: import { betterAuth } from "better-auth"; import { passkey, getAuthenticatorName } from "@better-auth/passkey"; export const auth = betterAuth({ plugins: [ passkey({ registration: { afterVerification: async ({ verification }) => ({ name: getAuthenticatorName(verification.registrationInfo?.aaguid), }), }, }), ], });

Example: Passkey configuration with registration extensions

Example of configuring the passkey plugin with registration extensions: import { betterAuth } from "better-auth" import { passkey } from "@better-auth/passkey" export const auth = betterAuth({ plugins: [ passkey({ registration: { requireSession: false, resolveUser: async ({ ctx, context }) => { return { id: "user-id", name: "user@example.com" } }, extensions: { credProps: true }, }, authentication: { extensions: { credProps: true }, }, }), ], })

Give your agent this brain