--- description: Capacitor plugin to create and authenticate with passkeys based on the WebAuthn standard. Supports Android, iOS, and the web. title: Capacitor Passkeys Plugin - Capawesome image: https://capawesome.io/docs/assets/images/social/sdks/capacitor/passkeys.png --- [Skip to content ](#capacitor-passkeys-plugin) [πŸ“² Introducing **Build Sharing** β€” get your builds onto testers' devices with a link & QR code. No account required. ](/blog/share-mobile-app-builds-with-testers/) * [ SDKs ](/docs/sdks/) * [ Formbricks ](/docs/sdks/capacitor/formbricks/) * [ Geocoder ](/docs/sdks/capacitor/geocoder/) * [ Google Sign-In ](/docs/sdks/capacitor/google-sign-in/) * [ Grafana Faro ](/docs/sdks/capacitor/grafana-faro/) * [ Gyroscope ](/docs/sdks/capacitor/gyroscope/) * [ Haptics ](/docs/sdks/capacitor/haptics/) * [ Home Indicator ](/docs/sdks/capacitor/home-indicator/) * [ In-App Browser ](/docs/sdks/capacitor/in-app-browser/) * [ Install Referrer ](/docs/sdks/capacitor/install-referrer/) * [ Intercom ](/docs/sdks/capacitor/intercom/) * [ Intune ](/docs/sdks/capacitor/intune/) * [ Keep Awake ](/docs/sdks/capacitor/keep-awake/) * [ libSQL ](/docs/sdks/capacitor/libsql/) * [ Light Sensor ](/docs/sdks/capacitor/light-sensor/) * [ Live Update ](/docs/sdks/capacitor/live-update/) * [ Localization ](/docs/sdks/capacitor/localization/) * [ Mail Composer ](/docs/sdks/capacitor/mail-composer/) * [ Managed Configurations ](/docs/sdks/capacitor/managed-configurations/) * [ Maps Launcher ](/docs/sdks/capacitor/maps-launcher/) * [ Media Session ](/docs/sdks/capacitor/media-session/) * [ ML Kit ](/docs/sdks/capacitor/mlkit/) * [ Navigation Bar ](/docs/sdks/capacitor/navigation-bar/) * [ Network ](/docs/sdks/capacitor/network/) * [ NFC ](/docs/sdks/capacitor/nfc/) * [ Node.js ](/docs/sdks/capacitor/nodejs/) * [ OAuth ](/docs/sdks/capacitor/oauth/) * Passkeys [ Passkeys ](/docs/sdks/capacitor/passkeys/) * [ iOS ](#ios) * [ Configuration ](#configuration) * [ Usage ](#usage) * [ API ](#api) * [ Type Aliases ](#type-aliases) * [ Testing ](#testing) * [ Limitations ](#limitations) * [ FAQ ](#faq) * [ Related Plugins ](#related-plugins) * [ Newsletter ](#newsletter) * [ Changelog ](#changelog) * [ License ](#license) * [ Password Autofill ](/docs/sdks/capacitor/password-autofill/) * [ PDF Generator ](/docs/sdks/capacitor/pdf-generator/) * [ PDF Viewer ](/docs/sdks/capacitor/pdf-viewer/) * [ Pedometer ](/docs/sdks/capacitor/pedometer/) * [ Permissions ](/docs/sdks/capacitor/permissions/) * [ Phone Dialer ](/docs/sdks/capacitor/phone-dialer/) * [ Photo Editor ](/docs/sdks/capacitor/photo-editor/) * [ Photo Manipulator ](/docs/sdks/capacitor/photo-manipulator/) * [ PixLive ](/docs/sdks/capacitor/pixlive/) * [ PostHog ](/docs/sdks/capacitor/posthog/) * [ Printer ](/docs/sdks/capacitor/printer/) * [ Privacy Screen ](/docs/sdks/capacitor/privacy-screen/) * [ Proximity Sensor ](/docs/sdks/capacitor/proximity-sensor/) * [ Purchases ](/docs/sdks/capacitor/purchases/) * [ RealtimeKit ](/docs/sdks/capacitor/realtimekit/) * [ Root Detection ](/docs/sdks/capacitor/root-detection/) * [ Screen Brightness ](/docs/sdks/capacitor/screen-brightness/) * [ Screen Orientation ](/docs/sdks/capacitor/screen-orientation/) * [ Screen Reader ](/docs/sdks/capacitor/screen-reader/) * [ Screenshot ](/docs/sdks/capacitor/screenshot/) * [ Secure Preferences ](/docs/sdks/capacitor/secure-preferences/) * [ Settings Launcher ](/docs/sdks/capacitor/settings-launcher/) * [ Shake ](/docs/sdks/capacitor/shake/) * [ Silent Mode ](/docs/sdks/capacitor/silent-mode/) * [ SIM ](/docs/sdks/capacitor/sim/) * [ SMS Composer ](/docs/sdks/capacitor/sms-composer/) * [ Speech Recognition ](/docs/sdks/capacitor/speech-recognition/) * [ Speech Synthesis ](/docs/sdks/capacitor/speech-synthesis/) * [ Share Target ](/docs/sdks/capacitor/share-target/) * [ Square Mobile Payments ](/docs/sdks/capacitor/square-mobile-payments/) * [ SQLite ](/docs/sdks/capacitor/sqlite/) * [ Superwall ](/docs/sdks/capacitor/superwall/) * [ System WebView ](/docs/sdks/capacitor/system-webview/) * [ Tauri ](/docs/sdks/capacitor/tauri/) * [ Text Interaction ](/docs/sdks/capacitor/text-interaction/) * [ Text Zoom ](/docs/sdks/capacitor/text-zoom/) * [ Thermal State ](/docs/sdks/capacitor/thermal-state/) * [ Toast ](/docs/sdks/capacitor/toast/) * [ Torch ](/docs/sdks/capacitor/torch/) * [ Vault ](/docs/sdks/capacitor/vault/) * [ Volume ](/docs/sdks/capacitor/volume/) * [ Wallet ](/docs/sdks/capacitor/wallet/) * [ Wifi ](/docs/sdks/capacitor/wifi/) * [ YouTube Player ](/docs/sdks/capacitor/youtube-player/) * [ Zip ](/docs/sdks/capacitor/zip/) * [ Cordova ](/docs/sdks/cordova/) * [ Cloud ](/docs/cloud/) * [ Integrations ](/docs/cloud/live-updates/integrations/) * Concepts * Reference * [ Troubleshooting ](/docs/cloud/live-updates/troubleshooting/) * [ FAQ ](/docs/cloud/live-updates/faq/) * [ Native Builds ](/docs/cloud/native-builds/) * [ Set Up Environments ](/docs/cloud/native-builds/environments/) * [ Overwrite Native Configurations ](/docs/cloud/native-builds/native-configurations/) * [ Auto-Increment Build Numbers ](/docs/cloud/native-builds/auto-incrementing-build-numbers/) * [ Configure the Web Build Script ](/docs/cloud/native-builds/web-build-script/) * [ Build from a Monorepo ](/docs/cloud/native-builds/monorepo/) * [ Use pnpm, Yarn, or bun ](/docs/cloud/native-builds/package-managers/) * [ Install Private npm Packages ](/docs/cloud/native-builds/npm-private-registry/) * [ Override the Java Version ](/docs/cloud/native-builds/override-java-version/) * [ Custom iOS Provisioning Profiles ](/docs/cloud/native-builds/custom-ios-provisioning-profiles/) * [ Build without Git ](/docs/cloud/native-builds/build-without-git/) * [ Access Git Behind a Firewall ](/docs/cloud/native-builds/firewall-access/) * [ Integrations ](/docs/cloud/native-builds/integrations/) * Reference * [ Troubleshooting ](/docs/cloud/native-builds/troubleshooting/) * [ FAQ ](/docs/cloud/native-builds/faq/) * [ App Store Publishing ](/docs/cloud/app-store-publishing/) * [ Submit a Build ](/docs/cloud/app-store-publishing/submit-a-build/) * [ Submit Automatically After a Build ](/docs/cloud/app-store-publishing/submit-automatically/) * [ Troubleshooting ](/docs/cloud/app-store-publishing/troubleshooting/) * [ FAQ ](/docs/cloud/app-store-publishing/faq/) * [ Automations ](/docs/cloud/automations/) * [ Reference ](/docs/cloud/automations/reference/) * [ Troubleshooting ](/docs/cloud/automations/troubleshooting/) * [ FAQ ](/docs/cloud/automations/faq/) * [ Assist ](/docs/cloud/assist/) * [ CLI ](/docs/cloud/cli/) * APIs and SDKs * [ Webhooks ](/docs/cloud/webhooks/) * [ Integrations ](/docs/cloud/integrations/) * Notifications * Account * [ Organization ](/docs/cloud/organizations/) * [ Two-Factor Enforcement ](/docs/cloud/organizations/two-factor-authentication/) * [ Audit Logs ](/docs/cloud/organizations/audit-logs/) * [ Billing ](/docs/cloud/organizations/billing/) * [ License Keys ](/docs/cloud/license-keys/) * [ AI ](/docs/ai/) * [ Insiders ](/docs/insiders/) * [ Billing & Plans ](/docs/insiders/billing-and-plans/) * [ FAQ ](/docs/insiders/faq/) * [ License ](https://capawesome.io/legal/eula/) * [ Support ](/docs/support/) * [ Contributing ](/docs/contributing/) * Contributing code * [ Code of Conduct ](/docs/contributing/code-of-conduct/) * [ Questions ](https://docs.github.com/en/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion#creating-a-discussion) * [ Blog ](/blog/) * Categories * [ iOS ](#ios) * [ Configuration ](#configuration) * [ Usage ](#usage) * [ API ](#api) * [ Type Aliases ](#type-aliases) * [ Testing ](#testing) * [ Limitations ](#limitations) * [ FAQ ](#faq) * [ Related Plugins ](#related-plugins) * [ Newsletter ](#newsletter) * [ Changelog ](#changelog) * [ License ](#license) # Capacitor Passkeys Plugin[ΒΆ](#capacitor-passkeys-plugin "Permanent link") Capacitor plugin to create and authenticate with [passkeys](https://fidoalliance.org/passkeys/) based on the [WebAuthn](https://www.w3.org/TR/webauthn-2/) standard. [ ![Deliver Live Updates to your Capacitor app with Capawesome Cloud](../../../assets/external/cloud.capawesome.io/assets/banners/cloud-build-and-deploy-capacitor-apps.69628c3f.png) ](https://cloud.capawesome.io/) ## Features[ΒΆ](#features "Permanent link") The Capacitor Passkeys plugin is one of the most complete passkey authentication solutions for Capacitor apps. Here are some of the key features: * πŸ” **Passkey creation**: Register new passkeys with the platform authenticator. * πŸ”‘ **Passkey authentication**: Authenticate users with their existing passkeys. * 🌐 **WebAuthn standard**: Uses the WebAuthn JSON serialization so any WebAuthn server library works unchanged. * πŸ“± **Availability check**: Check if passkeys are available on the device. * πŸ–₯️ **Web support**: Full web support via the native WebAuthn browser API. * 🀝 **Compatibility**: Works alongside the [Biometrics](https://capawesome.io/docs/sdks/capacitor/biometrics/) and [OAuth](https://capawesome.io/docs/sdks/capacitor/oauth/) plugins. * πŸ“¦ **CocoaPods & SPM**: Supports CocoaPods and Swift Package Manager for iOS. * πŸ” **Up-to-date**: Always supports the latest Capacitor version. Missing a feature? Just [open an issue](https://github.com/capawesome-team/capacitor-plugins/issues) and we'll take a look! ## Use Cases[ΒΆ](#use-cases "Permanent link") The Passkeys plugin is typically used to modernize the authentication of an app, for example: * **Passwordless sign-in**: Let users authenticate with a passkey instead of typing a password. * **Passkey enrollment**: Let existing users register a passkey for their account after they signed in with their current credentials. * **Progressive enhancement**: Check with `isAvailable()` whether passkeys are supported on the device and offer them as an alternative to your existing login. * **Server integration**: Pass the options and results of any WebAuthn server library through unchanged, thanks to the WebAuthn JSON serialization. ## Compatibility[ΒΆ](#compatibility "Permanent link") | Plugin Version | Capacitor Version | Status | | -------------- | ----------------- | -------------- | | 0.x.x | \>=8.x.x | Active support | ## Installation[ΒΆ](#installation "Permanent link") You can use our **AI-Assisted Setup** to install the plugin. Add the [Capawesome Skills](https://github.com/capawesome-team/skills) to your AI tool using the following command: `[](#%5F%5Fcodelineno-0-1)npx skills add capawesome-team/skills --skill capacitor-plugins ` Then use the following prompt: `` [](#%5F%5Fcodelineno-1-1) Use the `capacitor-plugins` skill from `capawesome-team/skills` to install the `@capawesome/capacitor-passkeys` plugin in my project. `` If you prefer **Manual Setup**, install the plugin by running the following commands and follow the platform-specific instructions below: `[](#%5F%5Fcodelineno-2-1)npm install @capawesome/capacitor-passkeys [](#%5F%5Fcodelineno-2-2)npx cap sync ` ### Android[ΒΆ](#android "Permanent link") On Android, passkeys are supported on Android 9 (API level 28) and higher with an available credential provider (e.g. Google Password Manager). #### Variables[ΒΆ](#variables "Permanent link") This plugin will use the following project variables (defined in your app’s `variables.gradle` file): * `$androidxCredentialsVersion` version of `androidx.credentials:credentials` and `androidx.credentials:credentials-play-services-auth` (default: `1.5.0`) #### Digital Asset Links[ΒΆ](#digital-asset-links "Permanent link") Your app must be associated with the domain of the relying party (`rp.id` / `rpId`) using [Digital Asset Links](https://developers.google.com/digital-asset-links). For this, host a JSON file at `https:///.well-known/assetlinks.json` that delegates the `common.get_login_creds` permission to your app: `[](#%5F%5Fcodelineno-3-1)[ [](#%5F%5Fcodelineno-3-2) { [](#%5F%5Fcodelineno-3-3) "relation": [ [](#%5F%5Fcodelineno-3-4) "delegate_permission/common.handle_all_urls", [](#%5F%5Fcodelineno-3-5) "delegate_permission/common.get_login_creds" [](#%5F%5Fcodelineno-3-6) ], [](#%5F%5Fcodelineno-3-7) "target": { [](#%5F%5Fcodelineno-3-8) "namespace": "android_app", [](#%5F%5Fcodelineno-3-9) "package_name": "com.example.app", [](#%5F%5Fcodelineno-3-10) "sha256_cert_fingerprints": [ [](#%5F%5Fcodelineno-3-11) "01:23:45:67:89:AB:CD:EF:01:23:45:67:89:AB:CD:EF:01:23:45:67:89:AB:CD:EF:01:23:45:67:89:AB:CD:EF" [](#%5F%5Fcodelineno-3-12) ] [](#%5F%5Fcodelineno-3-13) } [](#%5F%5Fcodelineno-3-14) } [](#%5F%5Fcodelineno-3-15)] ` Replace `com.example.app` with the application ID of your app and the fingerprint with the SHA-256 fingerprint of your app's signing certificate. Otherwise, the plugin methods will reject with the `DOMAIN_NOT_ASSOCIATED` error code. ### iOS[ΒΆ](#ios "Permanent link") On iOS, passkeys are supported on iOS 15 and higher. #### Associated Domains[ΒΆ](#associated-domains "Permanent link") Your app must be associated with the domain of the relying party (`rp.id` / `rpId`). For this, add the [Associated Domains](https://developer.apple.com/documentation/xcode/supporting-associated-domains) capability with the `webcredentials` service type to your app: `[](#%5F%5Fcodelineno-4-1)com.apple.developer.associated-domains [](#%5F%5Fcodelineno-4-2) [](#%5F%5Fcodelineno-4-3) webcredentials:example.com [](#%5F%5Fcodelineno-4-4) ` Additionally, host an [apple-app-site-association](https://developer.apple.com/documentation/xcode/supporting-associated-domains) file at `https:///.well-known/apple-app-site-association`: `[](#%5F%5Fcodelineno-5-1){ [](#%5F%5Fcodelineno-5-2) "webcredentials": { [](#%5F%5Fcodelineno-5-3) "apps": ["TEAMID.com.example.app"] [](#%5F%5Fcodelineno-5-4) } [](#%5F%5Fcodelineno-5-5)} ` Replace `TEAMID` with your Apple Developer Team ID and `com.example.app` with the bundle identifier of your app. Otherwise, the plugin methods will reject with the `DOMAIN_NOT_ASSOCIATED` error code. ## Configuration[ΒΆ](#configuration "Permanent link") No configuration required for this plugin. ## Usage[ΒΆ](#usage "Permanent link") The following examples show how to create a new passkey, authenticate with an existing passkey, and check whether passkeys are available on the device. ### Create a new passkey[ΒΆ](#create-a-new-passkey "Permanent link") Register a new passkey for a user account. In a real app, the options must be provided by your WebAuthn server, and the result must be passed back to it for verification: `` [](#%5F%5Fcodelineno-6-1)import { Passkeys } from '@capawesome/capacitor-passkeys'; [](#%5F%5Fcodelineno-6-2) [](#%5F%5Fcodelineno-6-3)const createPasskey = async () => { [](#%5F%5Fcodelineno-6-4) // In a real app, the options must be provided by your WebAuthn server, [](#%5F%5Fcodelineno-6-5) // e.g. via `generateRegistrationOptions()` from SimpleWebAuthn. [](#%5F%5Fcodelineno-6-6) const result = await Passkeys.createPasskey({ [](#%5F%5Fcodelineno-6-7) attestation: 'none', [](#%5F%5Fcodelineno-6-8) authenticatorSelection: { [](#%5F%5Fcodelineno-6-9) residentKey: 'required', [](#%5F%5Fcodelineno-6-10) userVerification: 'required', [](#%5F%5Fcodelineno-6-11) }, [](#%5F%5Fcodelineno-6-12) challenge: 'dGhpc2lzYWNoYWxsZW5nZQ', [](#%5F%5Fcodelineno-6-13) pubKeyCredParams: [ [](#%5F%5Fcodelineno-6-14) { alg: -7, type: 'public-key' }, [](#%5F%5Fcodelineno-6-15) { alg: -257, type: 'public-key' }, [](#%5F%5Fcodelineno-6-16) ], [](#%5F%5Fcodelineno-6-17) rp: { id: 'example.com', name: 'Example Inc.' }, [](#%5F%5Fcodelineno-6-18) user: { [](#%5F%5Fcodelineno-6-19) displayName: 'Jane Doe', [](#%5F%5Fcodelineno-6-20) id: 'anVzdGFyYW5kb21pZA', [](#%5F%5Fcodelineno-6-21) name: 'jane.doe@example.com', [](#%5F%5Fcodelineno-6-22) }, [](#%5F%5Fcodelineno-6-23) }); [](#%5F%5Fcodelineno-6-24) // Pass the result to your WebAuthn server for verification, [](#%5F%5Fcodelineno-6-25) // e.g. via `verifyRegistrationResponse()` from SimpleWebAuthn. [](#%5F%5Fcodelineno-6-26) return result; [](#%5F%5Fcodelineno-6-27)}; `` ### Authenticate with an existing passkey[ΒΆ](#authenticate-with-an-existing-passkey "Permanent link") Sign a user in with a passkey that was previously created for your relying party. Again, the options come from your WebAuthn server and the result is verified by it: `` [](#%5F%5Fcodelineno-7-1)import { Passkeys } from '@capawesome/capacitor-passkeys'; [](#%5F%5Fcodelineno-7-2) [](#%5F%5Fcodelineno-7-3)const getPasskey = async () => { [](#%5F%5Fcodelineno-7-4) // In a real app, the options must be provided by your WebAuthn server, [](#%5F%5Fcodelineno-7-5) // e.g. via `generateAuthenticationOptions()` from SimpleWebAuthn. [](#%5F%5Fcodelineno-7-6) const result = await Passkeys.getPasskey({ [](#%5F%5Fcodelineno-7-7) challenge: 'dGhpc2lzYWNoYWxsZW5nZQ', [](#%5F%5Fcodelineno-7-8) rpId: 'example.com', [](#%5F%5Fcodelineno-7-9) userVerification: 'required', [](#%5F%5Fcodelineno-7-10) }); [](#%5F%5Fcodelineno-7-11) // Pass the result to your WebAuthn server for verification, [](#%5F%5Fcodelineno-7-12) // e.g. via `verifyAuthenticationResponse()` from SimpleWebAuthn. [](#%5F%5Fcodelineno-7-13) return result; [](#%5F%5Fcodelineno-7-14)}; `` ### Check if passkeys are available[ΒΆ](#check-if-passkeys-are-available "Permanent link") Check whether passkeys are available on the device before offering them in your login UI. On Android, this returns `true` if the device runs Android 9 (API level 28) or higher. On iOS, this always returns `true`. On Web, this returns `true` if the browser supports WebAuthn and a user-verifying platform authenticator is available: `[](#%5F%5Fcodelineno-8-1)import { Passkeys } from '@capawesome/capacitor-passkeys'; [](#%5F%5Fcodelineno-8-2) [](#%5F%5Fcodelineno-8-3)const isAvailable = async () => { [](#%5F%5Fcodelineno-8-4) const { available } = await Passkeys.isAvailable(); [](#%5F%5Fcodelineno-8-5) return available; [](#%5F%5Fcodelineno-8-6)}; ` ## API[ΒΆ](#api "Permanent link") * [createPasskey(...)](#createpasskey) * [getPasskey(...)](#getpasskey) * [isAvailable()](#isavailable) * [Interfaces](#interfaces) * [Type Aliases](#type-aliases) ### createPasskey(...)[ΒΆ](#createpasskey "Permanent link") `[](#%5F%5Fcodelineno-9-1)createPasskey(options: CreatePasskeyOptions) => Promise ` Create (register) a new passkey. The options mirror the WebAuthn `PublicKeyCredentialCreationOptions` JSON serialization so that the values provided by any WebAuthn server library can be passed through unchanged. | Param | Type | | ----------- | --------------------------------------------- | | **options** | [CreatePasskeyOptions](#createpasskeyoptions) | **Returns:** `Promise<[CreatePasskeyResult](#createpasskeyresult)>` **Since:** 0.1.0 --- ### getPasskey(...)[ΒΆ](#getpasskey "Permanent link") `[](#%5F%5Fcodelineno-10-1)getPasskey(options: GetPasskeyOptions) => Promise ` Get (authenticate with) an existing passkey. The options mirror the WebAuthn `PublicKeyCredentialRequestOptions` JSON serialization so that the values provided by any WebAuthn server library can be passed through unchanged. | Param | Type | | ----------- | --------------------------------------- | | **options** | [GetPasskeyOptions](#getpasskeyoptions) | **Returns:** `Promise<[GetPasskeyResult](#getpasskeyresult)>` **Since:** 0.1.0 --- ### isAvailable()[ΒΆ](#isavailable "Permanent link") `[](#%5F%5Fcodelineno-11-1)isAvailable() => Promise ` Check if passkeys are available on this device. On **Android**, this returns `true` if the device runs Android 9 (API level 28) or higher. On **iOS**, this always returns `true`. On **Web**, this returns `true` if the browser supports WebAuthn and a user-verifying platform authenticator is available. **Returns:** `Promise<[IsAvailableResult](#isavailableresult)>` **Since:** 0.1.0 --- ### Interfaces[ΒΆ](#interfaces "Permanent link") #### CreatePasskeyResult[ΒΆ](#createpasskeyresult "Permanent link") The result of the passkey creation. This mirrors the WebAuthn `RegistrationResponseJSON` so it can be passed to any WebAuthn server library for verification. | Prop | Type | Description | Since | | --------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------- | ----- | | **authenticatorAttachment** | [PasskeyAuthenticatorAttachment](#passkeyauthenticatorattachment) | The attachment of the authenticator that created the passkey. | 0.1.0 | | **id** | string | The credential identifier as a base64url-encoded string. | 0.1.0 | | **rawId** | string | The raw credential identifier as a base64url-encoded string. | 0.1.0 | | **response** | [CreatePasskeyResponse](#createpasskeyresponse) | The response of the authenticator. | 0.1.0 | | **type** | 'public-key' | The credential type. | 0.1.0 | #### CreatePasskeyResponse[ΒΆ](#createpasskeyresponse "Permanent link") The response of the authenticator for the registration of a new passkey. This mirrors the WebAuthn `AuthenticatorAttestationResponse` JSON serialization. | Prop | Type | Description | Since | | ---------------------- | -------------------- | -------------------------------------------------------------------------------------------- | ----- | | **attestationObject** | string | The attestation object as a base64url-encoded string. | 0.1.0 | | **authenticatorData** | string | The authenticator data as a base64url-encoded string. Only available on Android and Web. | 0.1.0 | | **clientDataJSON** | string | The client data as a base64url-encoded string. | 0.1.0 | | **publicKey** | string | The DER-encoded public key as a base64url-encoded string. Only available on Android and Web. | 0.1.0 | | **publicKeyAlgorithm** | number | The COSE algorithm identifier of the public key. Only available on Android and Web. | 0.1.0 | | **transports** | PasskeyTransport\[\] | The transports that the authenticator supports. Only available on Android and Web. | 0.1.0 | #### CreatePasskeyOptions[ΒΆ](#createpasskeyoptions "Permanent link") | Prop | Type | Description | Default | Since | | -------------------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ----- | | **attestation** | [PasskeyAttestation](#passkeyattestation) | The attestation conveyance preference. | 'none' | 0.1.0 | | **authenticatorSelection** | [PasskeyAuthenticatorSelection](#passkeyauthenticatorselection) | Criteria that the authenticator must meet. | | 0.1.0 | | **challenge** | string | The challenge provided by the relying party server as a base64url-encoded string. | | 0.1.0 | | **excludeCredentials** | PasskeyCredentialDescriptor\[\] | Credentials that already exist for the user, so that the authenticator does not create a second passkey for the same account. On **iOS**, this option is only applied on iOS 17.4 and later. | | 0.1.0 | | **pubKeyCredParams** | PasskeyCredentialParameter\[\] | The public key credential types and algorithms that the relying party server supports, ordered from most to least preferred. Only available on Android and Web. | | 0.1.0 | | **rp** | [PasskeyRelyingParty](#passkeyrelyingparty) | The relying party for which the passkey is created. | | 0.1.0 | | **timeout** | number | The time in milliseconds that the caller is willing to wait for the operation to complete. Only available on Android and Web. | | 0.1.0 | | **user** | [PasskeyUser](#passkeyuser) | The user account for which the passkey is created. | | 0.1.0 | #### PasskeyAuthenticatorSelection[ΒΆ](#passkeyauthenticatorselection "Permanent link") Criteria that the authenticator must meet to create a passkey. | Prop | Type | Description | Default | Since | | --------------------------- | ----------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----- | | **authenticatorAttachment** | [PasskeyAuthenticatorAttachment](#passkeyauthenticatorattachment) | The authenticator attachment modality. Only available on Android and Web. | | 0.1.0 | | **requireResidentKey** | boolean | Whether or not a discoverable credential (passkey) is required. This property is retained for backwards compatibility with WebAuthn Level 1\. Prefer residentKey. Only available on Android and Web. | | 0.1.0 | | **residentKey** | [PasskeyResidentKey](#passkeyresidentkey) | The extent to which the relying party desires to create a discoverable credential (passkey). Only available on Android and Web. | | 0.1.0 | | **userVerification** | [PasskeyUserVerification](#passkeyuserverification) | The user verification requirement. | 'preferred' | 0.1.0 | #### PasskeyCredentialDescriptor[ΒΆ](#passkeycredentialdescriptor "Permanent link") A descriptor that identifies a specific credential. | Prop | Type | Description | Since | | -------------- | -------------------- | ---------------------------------------------------------------------------------------------------- | ----- | | **id** | string | The credential identifier as a base64url-encoded string. | 0.1.0 | | **transports** | PasskeyTransport\[\] | The transports that the authenticator of the credential supports. Only available on Android and Web. | 0.1.0 | | **type** | 'public-key' | The credential type. | 0.1.0 | #### PasskeyCredentialParameter[ΒΆ](#passkeycredentialparameter "Permanent link") A public key credential type and algorithm that the relying party server supports. | Prop | Type | Description | Since | | -------- | ------------ | --------------------------------------------------------------------- | ----- | | **alg** | number | The COSE algorithm identifier, e.g. \-7 for ES256 or \-257 for RS256. | 0.1.0 | | **type** | 'public-key' | The credential type. | 0.1.0 | #### PasskeyRelyingParty[ΒΆ](#passkeyrelyingparty "Permanent link") The relying party for which a passkey is created. | Prop | Type | Description | Since | | -------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------ | ----- | | **id** | string | The identifier of the relying party. This must be a registrable domain suffix of (or equal to) the domain that the app is associated with. | 0.1.0 | | **name** | string | The human-readable name of the relying party. | 0.1.0 | #### PasskeyUser[ΒΆ](#passkeyuser "Permanent link") The user account for which a passkey is created. | Prop | Type | Description | Since | | --------------- | ------ | ------------------------------------------------------------------------------ | ----- | | **displayName** | string | The human-readable display name of the user account. | 0.1.0 | | **id** | string | The user handle of the user account as a base64url-encoded string. | 0.1.0 | | **name** | string | The human-readable name of the user account, e.g. a username or email address. | 0.1.0 | #### GetPasskeyResult[ΒΆ](#getpasskeyresult "Permanent link") The result of the passkey authentication. This mirrors the WebAuthn `AuthenticationResponseJSON` so it can be passed to any WebAuthn server library for verification. | Prop | Type | Description | Since | | --------------------------- | ----------------------------------------------------------------- | -------------------------------------------------------------- | ----- | | **authenticatorAttachment** | [PasskeyAuthenticatorAttachment](#passkeyauthenticatorattachment) | The attachment of the authenticator that provided the passkey. | 0.1.0 | | **id** | string | The credential identifier as a base64url-encoded string. | 0.1.0 | | **rawId** | string | The raw credential identifier as a base64url-encoded string. | 0.1.0 | | **response** | [GetPasskeyResponse](#getpasskeyresponse) | The response of the authenticator. | 0.1.0 | | **type** | 'public-key' | The credential type. | 0.1.0 | #### GetPasskeyResponse[ΒΆ](#getpasskeyresponse "Permanent link") The response of the authenticator for the authentication with an existing passkey. This mirrors the WebAuthn `AuthenticatorAssertionResponse` JSON serialization. | Prop | Type | Description | Since | | --------------------- | ------ | ------------------------------------------------------------------------------------- | ----- | | **authenticatorData** | string | The authenticator data as a base64url-encoded string. | 0.1.0 | | **clientDataJSON** | string | The client data as a base64url-encoded string. | 0.1.0 | | **signature** | string | The signature as a base64url-encoded string. | 0.1.0 | | **userHandle** | string | The user handle (the user.id provided during creation) as a base64url-encoded string. | 0.1.0 | #### GetPasskeyOptions[ΒΆ](#getpasskeyoptions "Permanent link") | Prop | Type | Description | Default | Since | | -------------------- | --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----- | | **allowCredentials** | PasskeyCredentialDescriptor\[\] | The credentials that are acceptable to the relying party server. If not provided, the user can select from any discoverable credential (passkey) of the relying party. | | 0.1.0 | | **challenge** | string | The challenge provided by the relying party server as a base64url-encoded string. | | 0.1.0 | | **rpId** | string | The identifier of the relying party. | | 0.1.0 | | **timeout** | number | The time in milliseconds that the caller is willing to wait for the operation to complete. Only available on Android and Web. | | 0.1.0 | | **userVerification** | [PasskeyUserVerification](#passkeyuserverification) | The user verification requirement. | 'preferred' | 0.1.0 | #### IsAvailableResult[ΒΆ](#isavailableresult "Permanent link") | Prop | Type | Description | Since | | ------------- | ------- | ----------------------------------------------------- | ----- | | **available** | boolean | Whether or not passkeys are available on this device. | 0.1.0 | ### Type Aliases[ΒΆ](#type-aliases "Permanent link") #### PasskeyAuthenticatorAttachment[ΒΆ](#passkeyauthenticatorattachment "Permanent link") The authenticator attachment modality. `'cross-platform' | 'platform'` #### PasskeyTransport[ΒΆ](#passkeytransport "Permanent link") A transport that an authenticator supports. `'ble' | 'hybrid' | 'internal' | 'nfc' | 'smart-card' | 'usb'` #### PasskeyAttestation[ΒΆ](#passkeyattestation "Permanent link") The attestation conveyance preference. `'direct' | 'enterprise' | 'indirect' | 'none'` #### PasskeyResidentKey[ΒΆ](#passkeyresidentkey "Permanent link") The extent to which the relying party desires to create a discoverable credential (passkey). `'discouraged' | 'preferred' | 'required'` #### PasskeyUserVerification[ΒΆ](#passkeyuserverification "Permanent link") The user verification requirement. * `discouraged`: The relying party prefers no user verification. * `preferred`: The relying party prefers user verification but will not fail the operation without it. * `required`: The relying party requires user verification. `'discouraged' | 'preferred' | 'required'` ## Testing[ΒΆ](#testing "Permanent link") Keep the following in mind when testing your passkey integration: * **Real device recommended**: Test on a real device with a screen lock set up. On iOS, the Simulator supports passkeys since iOS 16\. On Android, the Emulator requires Google Play services and a Google account with Google Password Manager set up. * **WebAuthn server**: The challenges in this plugin's examples are only placeholders. In production, the options must be generated and the results must be verified by a WebAuthn server library such as [SimpleWebAuthn](https://simplewebauthn.dev/) (Node.js) or [java-webauthn-server](https://github.com/Yubico/java-webauthn-server) (Java). * **Domain association**: The relying party ID must be associated with your app (see the Installation section). Domain association changes can take some time to propagate, as the files are cached by Apple and Google. ## Limitations[ΒΆ](#limitations "Permanent link") Conditional UI (passkey autofill) is not supported by this plugin. The operating system autofill integrations target native text fields, not HTML inputs in a web view. ## FAQ[ΒΆ](#faq "Permanent link") ### How is this plugin different from other similar plugins?[ΒΆ](#how-is-this-plugin-different-from-other-similar-plugins "Permanent link") It implements the full WebAuthn standard using the JSON serialization, so the options and results from any WebAuthn server library pass through unchanged on Android, iOS, and the Web. Passkey creation, authentication, and an `isAvailable()` capability check are all covered through a fully typed, actively maintained API. If you only need a local face or fingerprint check, a simpler biometric setup is enough; if you want to replace passwords with server-verified passkeys across every platform, this plugin is designed for exactly that. ### Why do the plugin methods reject with the `DOMAIN_NOT_ASSOCIATED` error code?[ΒΆ](#why-do-the-plugin-methods-reject-with-the-domain%5Fnot%5Fassociated-error-code "Permanent link") This error means that your app is not associated with the domain of the relying party (`rp.id` / `rpId`). On Android, you must host a Digital Asset Links file at `https:///.well-known/assetlinks.json` that delegates the `common.get_login_creds` permission to your app. On iOS, you must add the Associated Domains capability with the `webcredentials` service type and host a matching `apple-app-site-association` file. See the [Installation](#installation) section for the details. Also keep in mind that changes to these files can take some time to propagate, as they are cached by Apple and Google. ### Do I need my own WebAuthn server to use this plugin?[ΒΆ](#do-i-need-my-own-webauthn-server-to-use-this-plugin "Permanent link") Yes. The challenges shown in the examples are only placeholders. In production, the options for `createPasskey(...)` and `getPasskey(...)` must be generated by a WebAuthn server, and the results must be verified by it, for example with a library such as [SimpleWebAuthn](https://simplewebauthn.dev/). Since the plugin uses the WebAuthn JSON serialization, any WebAuthn server library works unchanged. ### Which devices support passkeys?[ΒΆ](#which-devices-support-passkeys "Permanent link") On Android, passkeys are supported on Android 9 (API level 28) and higher with an available credential provider such as Google Password Manager. On iOS, passkeys are supported on iOS 15 and higher. On the web, passkeys are supported in browsers that implement WebAuthn with a user-verifying platform authenticator. Use the `isAvailable()` method to check the availability at runtime. ### Does this plugin support passkey autofill (Conditional UI)?[ΒΆ](#does-this-plugin-support-passkey-autofill-conditional-ui "Permanent link") No, Conditional UI is not supported. The operating system autofill integrations target native text fields, not HTML inputs in a web view. See the [Limitations](#limitations) section for more details. ### What is the difference between this plugin and the Biometrics plugin?[ΒΆ](#what-is-the-difference-between-this-plugin-and-the-biometrics-plugin "Permanent link") The [Biometrics](https://capawesome.io/docs/sdks/capacitor/biometrics/) plugin performs a local biometric check (e.g. face or fingerprint recognition) on the device, for example to protect a screen inside your app. The Passkeys plugin implements the WebAuthn standard, where the authentication is cryptographically verified by your server, making it suitable to replace password-based sign-in entirely. ### Can I use this plugin with Ionic, React, Vue or Angular?[ΒΆ](#can-i-use-this-plugin-with-ionic-react-vue-or-angular "Permanent link") Yes, the plugin is framework-agnostic. It works in any Capacitor app regardless of the web framework, including Ionic with Angular, React, or Vue, as well as plain JavaScript projects. ## Related Plugins[ΒΆ](#related-plugins "Permanent link") * [Biometrics](https://capawesome.io/docs/sdks/capacitor/biometrics/): Request biometric authentication, such as face or fingerprint recognition. * [OAuth](https://capawesome.io/docs/sdks/capacitor/oauth/): Communicate with OAuth 2.0 and OpenID Connect providers. * [Password Autofill](https://capawesome.io/docs/sdks/capacitor/password-autofill/): Save passwords to the platform credential store. * [Secure Preferences](https://capawesome.io/docs/sdks/capacitor/secure-preferences/): Securely store key/value pairs such as passwords or tokens. ## Newsletter[ΒΆ](#newsletter "Permanent link") Stay up to date with the latest news and updates about the Capawesome, Capacitor, and Ionic ecosystem by subscribing to our [Capawesome Newsletter](https://cloud.capawesome.io/newsletter/). ## Changelog[ΒΆ](#changelog "Permanent link") See [CHANGELOG.md](https://github.com/capawesome-team/capacitor-plugins/blob/main/packages/passkeys/CHANGELOG.md). ## License[ΒΆ](#license "Permanent link") See [LICENSE](https://github.com/capawesome-team/capacitor-plugins/blob/main/packages/passkeys/LICENSE). July 8, 2026 Back to top ```json {"@context": "https://schema.org", "@graph": [{"@type": "TechArticle", "@id": "https://capawesome.io/docs/sdks/capacitor/passkeys/#article", "headline": "Capacitor Passkeys Plugin", "name": "Capacitor Passkeys Plugin", "description": "Capacitor plugin to create and authenticate with passkeys based on the WebAuthn standard. Supports Android, iOS, and the web.", "inLanguage": "en", "url": "https://capawesome.io/docs/sdks/capacitor/passkeys/", "mainEntityOfPage": "https://capawesome.io/docs/sdks/capacitor/passkeys/", "author": {"@type": "Organization", "name": "Capawesome", "url": "https://capawesome.io", "logo": {"@type": "ImageObject", "url": "https://capawesome.io/assets/images/logo.svg"}}, "publisher": {"@type": "Organization", "name": "Capawesome", "url": "https://capawesome.io", "logo": {"@type": "ImageObject", "url": "https://capawesome.io/assets/images/logo.svg"}}, "about": {"@id": "https://capawesome.io/docs/sdks/capacitor/passkeys/#software"}}, {"@type": "SoftwareSourceCode", "@id": "https://capawesome.io/docs/sdks/capacitor/passkeys/#software", "name": "Capacitor Passkeys Plugin", "description": "Capacitor plugin to create and authenticate with passkeys based on the WebAuthn standard. Supports Android, iOS, and the web.", "url": "https://capawesome.io/docs/sdks/capacitor/passkeys/", "programmingLanguage": "TypeScript", "runtimePlatform": "Capacitor", "codeRepository": "https://github.com/capawesome-team", "author": {"@type": "Organization", "name": "Capawesome", "url": "https://capawesome.io", "logo": {"@type": "ImageObject", "url": "https://capawesome.io/assets/images/logo.svg"}}, "publisher": {"@type": "Organization", "name": "Capawesome", "url": "https://capawesome.io", "logo": {"@type": "ImageObject", "url": "https://capawesome.io/assets/images/logo.svg"}}}]} {"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "How is this plugin different from other similar plugins?", "acceptedAnswer": {"@type": "Answer", "text": "It implements the full WebAuthn standard using the JSON serialization, so the options and results from any WebAuthn server library pass through unchanged on Android, iOS, and the Web. Passkey creation, authentication, and an isAvailable() capability check are all covered through a fully typed, actively maintained API. If you only need a local face or fingerprint check, a simpler biometric setup is enough; if you want to replace passwords with server-verified passkeys across every platform, this plugin is designed for exactly that."}}, {"@type": "Question", "name": "Why do the plugin methods reject with the DOMAIN_NOT_ASSOCIATED error code?", "acceptedAnswer": {"@type": "Answer", "text": "This error means that your app is not associated with the domain of the relying party ( rp.id / rpId). On Android, you must host a Digital Asset Links file at https:///.well-known/assetlinks.json that delegates the common.get_login_creds permission to your app. On iOS, you must add the Associated Domains capability with the webcredentials service type and host a matching apple-app-site-association file. See the Installation section for the details. Also keep in mind that changes to these files can take some time to propagate, as they are cached by Apple and Google."}}, {"@type": "Question", "name": "Do I need my own WebAuthn server to use this plugin?", "acceptedAnswer": {"@type": "Answer", "text": "Yes. The challenges shown in the examples are only placeholders. In production, the options for createPasskey(...) and getPasskey(...) must be generated by a WebAuthn server, and the results must be verified by it, for example with a library such as SimpleWebAuthn. Since the plugin uses the WebAuthn JSON serialization, any WebAuthn server library works unchanged."}}, {"@type": "Question", "name": "Which devices support passkeys?", "acceptedAnswer": {"@type": "Answer", "text": "On Android, passkeys are supported on Android 9 (API level 28) and higher with an available credential provider such as Google Password Manager. On iOS, passkeys are supported on iOS 15 and higher. On the web, passkeys are supported in browsers that implement WebAuthn with a user-verifying platform authenticator. Use the isAvailable() method to check the availability at runtime."}}, {"@type": "Question", "name": "Does this plugin support passkey autofill (Conditional UI)?", "acceptedAnswer": {"@type": "Answer", "text": "No, Conditional UI is not supported. The operating system autofill integrations target native text fields, not HTML inputs in a web view. See the Limitations section for more details."}}, {"@type": "Question", "name": "What is the difference between this plugin and the Biometrics plugin?", "acceptedAnswer": {"@type": "Answer", "text": "The Biometrics plugin performs a local biometric check (e.g. face or fingerprint recognition) on the device, for example to protect a screen inside your app. The Passkeys plugin implements the WebAuthn standard, where the authentication is cryptographically verified by your server, making it suitable to replace password-based sign-in entirely."}}, {"@type": "Question", "name": "Can I use this plugin with Ionic, React, Vue or Angular?", "acceptedAnswer": {"@type": "Answer", "text": "Yes, the plugin is framework-agnostic. It works in any Capacitor app regardless of the web framework, including Ionic with Angular, React, or Vue, as well as plain JavaScript projects."}}], "url": "https://capawesome.io/docs/sdks/capacitor/passkeys/"} ```