Passkey ceremony recordings
Help test crypto/passkey, a proposed Go standard library package for signing in with passkeys.
This page runs a few WebAuthn ceremonies with your browser and authenticator, and records exactly what they produce, so the package can be tested against real devices rather than simulations.
Nothing personal is recorded: the account is a random ID made up for this session, and the passkey you create is for this site only. Delete it afterwards if you like.
Session
Everything you do is saved as you go, so if you stop halfway, what you did still helps. See the recording at any point.
This session records a conditional registration: a passkey created automatically, without prompting, right after you sign in with a password your password manager filled in.
Most password managers don't support this yet, so a refusal is not unexpected for many setups.
However, if your password manager won't save the password or fills it in wrong, please say so in the notes at the bottom.
-
Create a passkey
A registration with user verification preferred. Follow whatever your browser and authenticator ask.
-
Sign in
A login with user verification preferred. Pick the passkey you just created.
-
Sign in again, with allowCredentials
The same, but the site names the credential it expects, as it would for a re-authentication prompt in a signed-in session.
-
Sign in requiring user verification
A login with user verification required. Your browser may ask you to set up a PIN, or refuse: either is a useful result. Do this one last, as it can change your authenticator.
-
Optional: sign in from the autofill suggestions
A login through the autofill (conditional UI) path: click into the field and pick the passkey from the suggestions. If none is offered, click elsewhere and then into the field again.
If a password manager fills passwords for you in this browser — the built-in one, or an extension like 1Password — you can also record a conditional registration: the silent passkey creation some of them do right after a password sign-in. It's the rarest example we need. Two more minutes.
Have another authenticator? Start another session.