Simpler WebAuthn feature detection with getClientCapabilities()

Eiji Kitamura

Published: January 15, 2025

WebAuthn provides unique capabilities such as interaction with Bluetooth for the hybrid protocol, communication with passkey providers, and suggesting passkeys in autofill. However, different clients and authenticators offer varying levels of support for WebAuthn features. This disparity can lead to a fragmented user experience, where some users might encounter errors or be unable to utilize certain authentication options. Providing a way for developers to determine client capabilities enables them to create more robust authentication flows that adapt to these variations.

PublicKeyCredential.getClientCapabilities() method allows relying parties to determine which WebAuthn features are supported by the browser. The method returns a promise that resolves to a list of supported capabilities, allowing developers to tailor authentication experiences and workflows based on the client's specific capabilities.

Compatibility

Browser Support

getClientCapabilities()

The getClientCapabilities() is a WebAuthn API that allows relying parties to determine which capabilities are available. To use the API you need to call PublicKeyCredential.getClientCapabilities(). The returned promise resolves to an object that contains capabilities, each indicating its availability with true or false. If the capability is undefined, consider its availability is not known.

if (window.PublicKeyCredential &&
  if (PublicKeyCredential.getClientCapabilities) {
    const capabilities = await PublicKeyCredential.getClientCapabilities();
    if (capabilities.conditionalGet === true &&
        capabilities.passkeyPlatformAuthenticator === true) {
      // The browser supports passkeys and the conditional mediation.
    }
  }
}

conditionalCreate

The browser can create a credential without a prominent modal UI if the user has already consented to create one.

conditionalGet

The browser can authenticate by displaying passkeys as part of autofill dialog, instead of a prominent modal UI. Existing equivalent is PublicKeyCredential.isConditionalMediationAvailable().

hybridTransport

The device can use Bluetooth so that the browser can create a credential and authenticate with it cross-device using the hybrid protocol. This typically means the browser can display a QR code so that the user can scan it and sign in with a phone that has a credential on it.

passkeyPlatformAuthenticator

The browser can create a credential and authenticate with it through a user verifying platform authenticator or another device that supports it through the hybrid protocol. Equivalent to hybridTransport || userVerifyingPlatformAuthenticator.

relatedOrigins

The browser can create a credential and authenticate with it that does not match the RP ID, as long as it's specified in the related origins file.

signalAllAcceptedCredentials

The browser can signal available credentials on the server to the passkey provider, so that the passkey provider can keep the passkey list consistent with the server.

signalCurrentUserDetails

The browser can signal user information such as username and display name on the server to the passkey provider, so that the passkey provider can keep their passkey information consistent with the server.

signalUnknownCredential

The browser can signal a deleted credential on the server to the passkey provider, so that the passkey provider can keep the passkey list consistent with the server.

userVerifyingPlatformAuthenticator

The browser can create and authenticate with a credential on a platform authenticator. This does not mean the browser supports the hybrid protocol. Existing equivalent is PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable().

extensions

RPs can also determine available extensions with getClientCapabilities().

if (capabilities['extension:appid'] === true) {
  // appId extension is supported
}

The identifier is prefixed with extension: followed by an extension name. Refer to the WebAuthn Extension Identifiers defined at IANA for extension names.

Learn more

To learn more about passkeys, start from Passwordless login with passkeys.