passkey/options

7 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

rpID passkey option

The rpID is a unique identifier for the website based on the auth server origin. For local development, 'localhost' is acceptable. The RP ID can be formed by removing zero or more left labels from an effective domain until reaching an effective TLD. For example, www.example.com can use RP IDs 'www.example.com' or 'example.com', but not 'com' (an eTLD).

rpName passkey option

The rpName is a human-readable title for the website, used in the passkey plugin configuration.

origin passkey option

The origin is the URL at which the better-auth server is hosted. Valid formats include http://localhost and http://localhost:PORT. Do not include any trailing slash.

authenticatorSelection passkey option

The authenticatorSelection option allows customization of WebAuthn authenticator selection criteria. It contains: authenticatorAttachment (optional, 'platform' for device-bound like fingerprint, 'cross-platform' for external like security keys, defaults to both with platform preferred), residentKey (optional, 'required' for highest security with credential storage, 'preferred' to encourage but not require storage, 'discouraged' for fastest experience without storage, defaults to 'preferred'), userVerification (optional, 'required' for highest security with biometric/PIN, 'preferred' to encourage but not require, 'discouraged' for fastest experience without verification, defaults to 'preferred').

webAuthnChallengeCookie advanced option

The advanced.webAuthnChallengeCookie option sets the cookie name for storing WebAuthn challenge ID during authentication flow. Default value is 'better-auth-passkey'.

Passkey plugin with Expo cookiePrefix configuration

When using the passkey plugin with Expo, configure the cookiePrefix option in the Expo client to match the prefix of the webAuthnChallengeCookie. By default, the passkey plugin uses 'better-auth-passkey' as the challenge cookie name which starts with 'better-auth' and works with the default Expo client configuration. If customizing webAuthnChallengeCookie, update the Expo client's cookiePrefix to match. For custom cookie names, the cookiePrefix must match the prefix for passkey authentication to work. Multiple prefixes can be provided as an array.

Example: Expo client configuration with custom passkey cookie

Example of configuring the Expo client with a custom passkey cookie name: Server (auth.ts): import { betterAuth } from "better-auth"; import { passkey } from "@better-auth/passkey"; export const auth = betterAuth({ plugins: [ passkey({ advanced: { webAuthnChallengeCookie: "my-app-passkey" } }) ] }); Client (auth-client.ts): import { createAuthClient } from "better-auth/react"; import { expoClient } from "@better-auth/expo/client"; import { passkeyClient } from "@better-auth/passkey/client"; import * as SecureStore from "expo-secure-store"; export const authClient = createAuthClient({ baseURL: "http://localhost:8081", plugins: [ expoClient({ storage: SecureStore, cookiePrefix: "my-app" }), passkeyClient() ] });

Give your agent this brain