Credentials install method
The async Credentials.install() method, available since v1.61, installs the virtual WebAuthn authenticator into the context, overriding navigator.credentials.create() and navigator.credentials.get() in all current and future pages. It must be called before the page first touches navigator.credentials. Until install is called, no interception is in place and the page sees the platform's native (or absent) WebAuthn behaviour. Seeding credentials with Credentials.create without installing populates the authenticator, but the page will never see those credentials.
Credentials create method signature and return type
The async Credentials.create(rpId, options) method, available since v1.61, returns a VirtualCredential object. The VirtualCredential object has these properties: id (string, base64url-encoded credential id), rpId (string, relying party id), userHandle (string, base64url-encoded user handle), privateKey (string, base64url-encoded PKCS#8 (DER) private key), publicKey (string, base64url-encoded SPKI (DER) public key).
Credentials create method behaviour
Credentials.create seeds a virtual WebAuthn credential and returns it. With only rpId, it generates a fresh ECDSA P-256 keypair, credential id, and user handle. The seeded credential is discoverable (resident), so the page can resolve it from both username-then-passkey and usernameless passkey flows. To import a known credential, supply all four of id, userHandle, privateKey, and publicKey together. The returned object carries the private and public keys so it can be persisted to disk and re-seeded in a later test.
Credentials create parameter: rpId
The rpId parameter of Credentials.create, required since v1.61, is a string representing the relying party id (typically the site's effective domain).
Credentials create option: id
The id option of Credentials.create, available since v1.61, is a string containing a base64url-encoded credential id. It is auto-generated if omitted.
Credentials create option: userHandle
The userHandle option of Credentials.create, available since v1.61, is a string containing a base64url-encoded user handle. It is auto-generated if omitted.
Credentials create option: privateKey
The privateKey option of Credentials.create, available since v1.61, is a string containing a base64url-encoded PKCS#8 (DER) private key. It is auto-generated if omitted.
Credentials create option: publicKey
The publicKey option of Credentials.create, available since v1.61, is a string containing a base64url-encoded SPKI (DER) public key. It is auto-generated if omitted.
Credentials delete method signature
The async Credentials.delete(id) method, available since v1.61, removes a credential from the authenticator by its id. It works for any credential currently held — both those seeded with Credentials.create and those the page registered itself by calling navigator.credentials.create().
Credentials delete parameter: id
The id parameter of Credentials.delete, required since v1.61, is a string containing a base64url-encoded credential id.
Credentials get method signature and return type
The async Credentials.get(options) method, available since v1.61, returns an array of VirtualCredential objects. Each VirtualCredential object has these properties: id (string), rpId (string), userHandle (string), privateKey (string), publicKey (string).
Credentials get method behaviour
Credentials.get returns every credential currently held by the authenticator, optionally filtered by rpId or id. This includes both credentials seeded with Credentials.create and credentials the page registered itself by calling navigator.credentials.create(). Each returned credential includes its private and public keys, so a passkey the app just registered can be saved and re-seeded into a later test with Credentials.create.
Credentials get option: rpId
The rpId option of Credentials.get, available since v1.61, is a string that filters credentials to only return those for this relying party id.
Credentials get option: id
The id option of Credentials.get, available since v1.61, is a string containing a base64url-encoded credential id. When provided, only the credential with this id is returned.