LacspaceLacspace Developer
← All packages

@lacspace/webauthn

v1.1.1Security Kit0 deps

Passkeys / biometric (FaceID, fingerprint, security keys) — browser ceremony helpers + server challenge, options and assertion verification (ES256/RS256) over Web Crypto. Zero-dependency, isomorphic.

npm i @lacspace/webauthn
View on npm ↗GitHub ↗

Usage

webauthn.ts
// --- server: create options ---
import { generateRegistrationOptions, generateChallenge } from "@lacspace/webauthn";
const challenge = generateChallenge();               // store in the session
const options = generateRegistrationOptions({ rpName: "Lacspace", rpID: "lacspace.com", userID, userName, challenge });

// --- browser ---
import { startRegistration } from "@lacspace/webauthn";
const response = await startRegistration(options);   // FaceID / fingerprint prompt → JSON

// --- server: verify + store ---
import { verifyRegistration } from "@lacspace/webauthn";
const { credentialId, publicKey, algorithm, counter } = await verifyRegistration({
  attestationObject: response.attestationObject,
  clientDataJSON: response.clientDataJSON,
  expectedChallenge: challenge, expectedOrigin: "https://lacspace.com", expectedRPID: "lacspace.com",
});
// store { credentialId, publicKey (JWK), al

Exports 11

fromBase64urlgenerateAuthenticationOptionsgenerateChallengegenerateRegistrationOptionsisPlatformAuthenticatorAvailableisWebAuthnSupportedstartAuthenticationstartRegistrationtoBase64urlverifyAuthenticationverifyRegistration

Keywords

webauthnpasskeyfido2biometricfaceidfingerprint

More in Security Kit

@lacspace/apikey

Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, last-4 display. Isomorphic over Web Crypto.

@lacspace/crypto

Safe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2 key derivation, SHA-256, HMAC, secure random and constant-time compare. Isomorphic (Node, edge, browser, RN).

@lacspace/headers

Secure HTTP headers & a typed Content-Security-Policy builder — HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy. Framework-agnostic + Next.js. Zero-dependency, isomorphic.

@lacspace/jwt

JSON Web Tokens (HS256/384/512) with strict expiry/issuer/audience checks + secure random & CSRF tokens. Isomorphic over Web Crypto — Node, edge, browser.

@lacspace/lock

Account lockout & brute-force protection (server lock) — N-strikes, exponential backoff, self-resetting window, pluggable store. Zero-dependency, isomorphic.

@lacspace/mfa

Orchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL). Zero-dependency (bar @lacspace/otp), isomorphic.

← Browse all 76 packagesRead the handbook