Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hello, I'm trying to understand if the Kratos support for WebAuthn makes it possible to leverage the full user experience  for passkeys on Apple platforms, not only in the web browser, but also in native applications (iOS, macOS). Can anyone shed a light on this question?

Hey :wave:
I’m not an expert in this area, but I’ve seen this mentioned in the docs – <https://www.ory.sh/docs/kratos/mfa/webauthn-fido-yubikey#limitations>
&gt; • WebAuthn is a browser-only standard. It doesn’t work with native mobile apps.


Sometimes documentations are not up-to-date, though :wink:

Yup. That’s why I have added a disclaimer.
I would be happy to be corrected :slightly_smiling_face:

<https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys|Apple APIs> for passkeys require that the client application grabs a challenge from the server. But I indeed can not find any HTTP Kratos api that provides such a challenge in the <https://www.ory.sh/docs/kratos/reference/api|HTTP API doc>.

Let's see if someone can provide a clear answer.

I created a discussion on Github as well: <https://github.com/ory/kratos/discussions/3038>