Is is it possible to create a passkey on the same device you are using?

[treeder]

I've got it working on desktop and it will ask my phone to create the passkey. But if I'm on my phone, it gives me the options below, so I'm unable to create one.

[treeder]

I removed the whole authenticatorSelection and it now it seems to work properly, allowing me to create an passkey on the same device.

[MasterKale]

That looks like what I'd expect Android to pop up if residentKey: "discouraged" is being specified. The "new" WebAuthn functionality that allows registering synced passkeys requires at least residentKey: "preferred" if not residentKey: "required".

Note that preferring or requiring resident keys here will have a potentially unintended consequence of security keys creating and storing a "discoverable credential" (new name, same concept as resident keys) internally. As security keys have limited internal storage this can be seen as a bad thing by security key users. If you imagine you'll have a lot of users using security keys then you may want to consider alternative registration flows, one for "typical registration of just about anything" that sets residentKey: "required" to get the most consistent synced passkeys experience; and a second one specifically for security keys that specifies residentKey: "discouraged" with authenticatorAttachment: "cross-platform". Just my $0.02 from being in these trenches for so long ✌️

[treeder]

Ok, so here's what I get for various options (on desktop):

If I remove authenticatorAttachment and make residentKey required, I think it's doing what it should. Is that what you are suggesting?

If I specify platform or cross-platform, it doesn't do what I want.

[MasterKale]

If I remove authenticatorAttachment and make residentKey required, I think it's doing what it should. Is that what you are suggesting?

Wait the issue was that you were seeing the prompt in the screenshot above while your options contained authenticatorAttachment: "cross-platform"? Then I'd say that's things working as intended. If you want to register the user's local device then that's authenticatorAttachment: "platform".

The behavior you're seeing when you omit authenticatorAttachment is the phone wanting you to register the local platform authenticator because it's not being told by the RP (you) what kind of authenticator to get the user to register.

Does this make sense?

[treeder]

Ok, so here's what happens with various options:

Option 1: no authenticatorAttachment

  authenticatorSelection: {
                    residentKey: 'required',
                    userVerification: 'preferred',
                    // authenticatorAttachment: 'platform', // 'cross-platform',
                },

desktop:

mobile:

And if I click "use a different device":

So that option seems good and it appears to make a multiDevice synced key which is good.

Option 2: "platform"

 authenticatorSelection: {
                    residentKey: 'required',
                    userVerification: 'preferred',
                    authenticatorAttachment: 'platform', // 'cross-platform',
                },

desktop:

mobile:

So this one won't work on desktop and mobile only gives one option (ie: the local device), there is "use a different device" option.

Option 3: cross-platform

 authenticatorSelection: {
                    residentKey: 'required',
                    userVerification: 'preferred',
                    authenticatorAttachment: 'cross-platform',
                },

desktop:

Notice no local device option.

mobile:

Again, no local device option.

[treeder]

Based on that, I think the best option is to not define the authenticatorAttachment.

[MasterKale]

desktop:

This looks like you don't have a local platform authenticator installed. Are you on Linux by chance? Just curious.

But yeah, if you want to support the greatest number of use cases then it's best to omit authenticatorAttachment, especially now that hybrid registration is an option (so users in your similar situation can use their phone to register something backed by a platform authenticator and thus probably synced.)