Filippo Valsorda proposes an interoperable passkey record format (c2sp.org/passkey-record) that encodes WebAuthn credential data as opaque strings similar to password hash strings. The format uses PHC string syntax with base64-encoded authenticator data as the payload and transports as parameters. This abstraction lets applications treat passkeys like password hashes — storing opaque strings without needing to understand the internal structure — while remaining library- and backend-agnostic. A draft Go API (crypto/passkey) is also proposed, covering registration and login flows with a stateless design. The post also argues that the common recommendation to enforce unique Credential IDs across accounts is unnecessary when lookups are keyed by user ID rather than credential ID.
Table of contents
Other fields you might want to storeA potential crypto/passkey APIOn duplicate Credential IDsThe picture5.5K Impressions1 Comment