API ArcadeISSUE #17 of 23

webauthn · passkeys · biometrics

ApiaVSLegacy Larry

Apia saysWebAuthn enables passwordless login with passkeys, biometrics, and security keys.

WebAuthn (navigator.credentials.create/get) lets users authenticate with a fingerprint, face, or hardware key instead of a password — using public-key cryptography, so there's no shared secret to steal. The browser and authenticator handle the crypto; your server verifies the signed challenge. It's the backbone of passkeys and phishing-resistant auth.

Power-ups you unlock

Passwordless: biometrics, passkeys, security keys
navigator.credentials.create/get
Public-key crypto — no shared secret to steal
Phishing-resistant; the basis of passkeys

Legacy Larry attacks — common mistakes

Treating it as a drop-in without server verification
Skipping a fallback for unsupported devices
Misunderstanding the challenge/response flow

Boss battleUnderstand the WebAuthn flow: server challenge → authenticator signs → server verifies.

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre>// register a passkey (simplified)
const cred = await navigator.credentials.create({
  publicKey: { challenge, rp, user, pubKeyCredParams }
});
// server verifies the signed attestation</pre></body></html>

▶ Open the interactive comic issue

‹ Crypto Api · RandomUUID · Subtle.Digest Typescript · Adding Types To Js ›