@lacspace/webauthn

Passkeys & biometric (FaceID, fingerprint, security keys) via WebAuthn.

Everything for passwordless / biometric auth in one small package: browser ceremony helpers, server challenge & options builders, and real assertion verification (ES256/RS256) over Web Crypto — including the fiddly ES256 DER→P1363 conversion and a compact CBOR/COSE parser that extracts the public key at registration.

• 👆 Browser: startRegistration / startAuthentication, isPlatformAuthenticatorAvailable
• 🖥️ Server: generateChallenge, generateRegistrationOptions, generateAuthenticationOptions
• ✅ Server verify: verifyRegistration (extracts the public key), verifyAuthentication (signature + rpId + origin + challenge + counter)
• ⚡ Zero dependencies · 🌍 isomorphic (Web Crypto) · fully typed

Scope: performs origin / rpId / challenge / signature / sign-counter checks — the checks that matter for nearly every app — with "none" attestation. It does not verify the attestation-statement trust chain (device provenance); if you need enterprise attestation, pair it with a specialist verifier.

Install

npm install @lacspace/webauthn

Register a passkey

// --- server: create options ---
import { generateRegistrationOptions, generateChallenge } from "@lacspace/webauthn";
const challenge = generateChallenge();               // store in the session
const options = generateRegistrationOptions({ rpName: "Lacspace", rpID: "lacspace.com", userID, userName, challenge });

// --- browser ---
import { startRegistration } from "@lacspace/webauthn";
const response = await startRegistration(options);   // FaceID / fingerprint prompt → JSON

// --- server: verify + store ---
import { verifyRegistration } from "@lacspace/webauthn";
const { credentialId, publicKey, algorithm, counter } = await verifyRegistration({
  attestationObject: response.attestationObject,
  clientDataJSON: response.clientDataJSON,
  expectedChallenge: challenge, expectedOrigin: "https://lacspace.com", expectedRPID: "lacspace.com",
});
// store { credentialId, publicKey (JWK), algorithm, counter } against the user

Sign in with a passkey

// --- server ---
import { generateAuthenticationOptions } from "@lacspace/webauthn";
const challenge = generateChallenge();
const options = generateAuthenticationOptions({ rpID: "lacspace.com", allowCredentials: [credentialId], challenge });

// --- browser ---
import { startAuthentication } from "@lacspace/webauthn";
const response = await startAuthentication(options);

// --- server: verify ---
import { verifyAuthentication } from "@lacspace/webauthn";
const { verified, newCounter, userVerified } = await verifyAuthentication({
  authenticatorData: response.authenticatorData,
  clientDataJSON: response.clientDataJSON,
  signature: response.signature,
  publicKey, algorithm, counter,                       // from storage
  expectedChallenge: challenge, expectedOrigin: "https://lacspace.com", expectedRPID: "lacspace.com",
  requireUserVerification: true,                        // reject unless biometric/PIN was performed (UV flag)
});
if (verified) { /* update stored counter = newCounter, log the user in */ }

User verification (UV). Pass requireUserVerification: true to verifyAuthentication (or verifyRegistration) to reject assertions where the authenticator did not verify the user via biometric or PIN — enforce this when a passkey is your second factor or your sole credential. When the option is omitted, behaviour is unchanged (only User-Present is required). Both verifiers also return userVerified so you can record or branch on it.

API

| Export | Where | Description | | --- | --- | --- | | isWebAuthnSupported / isPlatformAuthenticatorAvailable | browser | feature detection | | startRegistration / startAuthentication | browser | run the ceremony | | generateChallenge | server | random challenge | | generateRegistrationOptions / generateAuthenticationOptions | server | build options JSON | | verifyRegistration / verifyAuthentication | server | verify + extract key |

The Lacspace Security Kit

| Package | For | | --- | --- | | @lacspace/crypto | AES encryption & hashing | | @lacspace/password | Password hashing | | @lacspace/jwt | JWTs & tokens | | @lacspace/apikey | API keys | | @lacspace/otp | TOTP/HOTP 2FA | | @lacspace/webauthn | Passkeys / biometric (this package) | | @lacspace/mfa | 2FA/3FA orchestration | | @lacspace/lock | Account lockout | | @lacspace/headers | Secure headers / CSP | | @lacspace/redact | Log redaction |

Licensing

This package is free under the Lacspace Free Licence — permissive freedoms. Use it in personal and commercial projects at no cost; just keep the notice.

Not every Lacspace package is free. We also offer Commercial (paid), Client-specific, and Private (proprietary) packages under separate terms. See the full Lacspace Licence Centre.

The Lacspace Developer Platform

@lacspace/webauthn is part of 80+ zero-dependency, isomorphic TypeScript packages — one standard library for the modern web. Explore the ecosystem:

• 📦 This package, documented — https://developer.lacspace.com/packages/webauthn
• 🗂️ All 80+ packages — https://developer.lacspace.com/packages
• 🧭 Developer handbook — guides & runnable recipes — https://developer.lacspace.com/handbook
• 🧪 Live playground — run any package in your browser — https://developer.lacspace.com/playground
• 🖥️ Finished app templates — https://templates.lacspace.com
• 🚀 Scaffold a full app — npm create lacspace-app@latest

Free under the Lacspace Free Licence — a permissive, free-to-use licence.