@1auth/authn-webauthn-securitykey
SecurityKey preset for @1auth/authn-webauthn: a roaming
authenticator used as a second factor.
Install
npm i @1auth/authn-webauthn-securitykeyUsage
import securityKey, { create, verify } from '@1auth/authn-webauthn-securitykey'
securityKey({
origin: process.env.ORIGIN,
name: 'Organization Name'
})
await create(sub)It is a configured @1auth/authn-webauthn module instance, so it carries the whole API — count, list, select, create, verify, authenticate, createChallenge, expire, remove.
Configuration options
Everything @1auth/authn-webauthn accepts, over these defaults:
| Option | Default | Why |
|---|---|---|
residentKey | 'discouraged' | A security key holds a limited number of discoverable credentials, and as a second factor it doesn’t need one |
userVerification | 'required' | Asked of the browser and enforced on verify. Overriding it to 'preferred' lets an authenticator without user verification in |
preferredAuthenticatorType | 'securityKey' | Sends hints and authenticatorAttachment so the browser prompts for a security key, and is enforced on verify — a synced PassKey is rejected with 401 Unauthorized |
id | 'WebAuthnSecurityKey' | Credentials are stored as {id}-{type}, so they never appear in @1auth/authn-webauthn-passkey’s list/allowCredentials |
notifyId | 'authn-webauthn-securitykey' | Prefix for the notify template ids: {notifyId}-create, {notifyId}-expire, {notifyId}-remove |
Notes
This holds its own createInstance(), so it and @1auth/authn-webauthn-passkey keep separate config. Everything else — @1auth/authn, @1auth/crypto, @1auth/account — is shared, so both use the same store, table, and
encryption keys.
Post-quantum
A configuration preset over @1auth/authn-webauthn and inherits its post-quantum status: authenticator-signed ES256/RS256 assertions, migrating as the WebAuthn ecosystem does. See the full assessment in Post-quantum.