WebAuthx
https://github.com/wevm/webauthx- Category
- Cybersecurity
- Rank
- No. 1083Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- wevm
- GitHub
- 63 stars
- Latest release
- webauthx@0.1.2
- Date
About
Tools for Passkey authentication from the wevm team (Wagmi, Viem). High-level WebAuthn primitives for modern web apps.
What it does
WebAuthx coordinates passkey signup and login across browser and server boundaries. The server creates a random challenge and serialized credential options. The browser asks the device to create or use a credential. The server then checks the returned challenge, origin, relying party identity, attestation, or signature.
Why it's ranked here
The scope is narrow but coherent. Typed client and server entry points cover both ceremonies, while browser tests exercise real registration and authentication flows in headless Chromium. It also rejects authentication with the wrong challenge or public key. Applications must still supply storage, routing, sessions, and account policy.
What's good
Serialized options and responses make the network boundary explicit instead of hiding it. Challenges default to 32 random bytes, and verification checks the relying party hash, origin, challenge, and P-256 signature. Registration extracts the public key and authenticator identifier. Custom credential and fetch implementations make focused testing possible.
Tradeoffs
This is a library, not a complete authentication service. The application must persist and consume single-use challenges, store credentials, connect them to users, and establish sessions after verification. Authenticator names require fetching a remote registry unless callers provide another source. Authentication verification is specifically built around stored P-256 public keys.
How to use it well
Use it when a TypeScript application already owns its server routes, user records, credential storage, and session lifecycle, but needs a compact passkey ceremony layer. Keep challenges short-lived and single-use, bind verification to exact origins and relying party identifiers, and persist returned counters and public keys. Choose another system for full account management or hosted identity.
Technical notes+
package.json defines an ESM npm package with MIT licensing, ox as its sole runtime dependency, side-effect-free metadata, declarations, and separate root, client, and server exports. src/client/Registration.ts and src/client/Authentication.ts deserialize server options, invoke browser WebAuthn operations, and serialize results. src/server/Registration.ts and src/server/Authentication.ts generate random 32-byte challenges through ox, serialize options, deserialize responses, and verify ceremonies. src/server/Aaguid.ts extracts AAGUID bytes from CBOR attestation data and caches remote registry requests by URL. vitest.config.ts separates unit tests from Playwright-backed headless Chromium tests, including full registration and authentication flows under src/_test/Registration.browser.test.ts and src/_test/Authentication.browser.test.ts.
Observed
- License
- MIT
- Primary language
- TypeScript
- Packaging
- ES module npm package installable with npm, pnpm, or Bun
- Interface
- Library with separate client and server exports
- Runtime dependency
- ox is the sole declared runtime dependency
- Test structure
- Vitest unit tests plus Playwright-backed headless Chromium browser tests
Read from README.md, package.json, src/index.ts, src/client/index.ts, src/server/index.ts, src/server/Aaguid.ts, src/internal/types.ts, src/server/Aaguid.test.ts, src/client/Registration.ts, src/server/Registration.ts, src/client/Authentication.ts, src/server/Authentication.ts, src/_test/Registration.browser.test.ts, src/_test/Authentication.browser.test.ts, vitest.config.ts.
What it can do
Register new passkey credentials
User authentication request and device biometrics → Cryptographic passkey credential
Authenticate users with existing passkeys
Passkey credential and user verification → Authentication result and user session
Generate WebAuthn challenge tokens
Authentication request parameters → Cryptographic challenge token
Verify WebAuthn assertion responses
Signed assertion response from authenticator → Verification status and user identity
Manage authenticator device registration
Device capabilities and user preferences → Registered authenticator configuration
Handle cross-platform authentication flows
Multi-device authentication requests → Synchronized authentication state
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.