> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# WebAuthn API | FusionAuth Docs

Learn about the APIs for starting and completing WebAuthn ceremonies and retrieving, importing and deleting WebAuthn passkeys.

# WebAuthn API

[Edit on GitHub](https://github.com/FusionAuth/fusionauth-site/blob/main/astro/src/content/docs/apis/webauthn/index.mdx)

[View Markdown](https://fusionauth.io/docs/apis/webauthn.md)

This feature is available to licensed FusionAuth instances as of version `1.52.0`. To register for a free license, visit the **Plan** tab in the [account portal](https://account.fusionauth.io/).

Available since version `1.41.0`

This page contains all of the APIs for managing WebAuthn passkeys, sometimes referred to as credentials, and starting and completing WebAuthn ceremonies.

The following APIs are provided to manage WebAuthn passkeys.

| Operation | Method | Endpoint |
| --- | --- | --- |
| [Retrieve a Passkey](https://fusionauth.io/docs/apis/webauthn/retrieve-a-passkey.md) | `GET` | `/api/webauthn/{id}`  
`/api/webauthn?userId={userId}` |
| [Delete a Passkey](https://fusionauth.io/docs/apis/webauthn/delete-a-passkey.md) | `DELETE` | `/api/webauthn/{id}`  
`/api/webauthn?userId={userId}` |
| [Import Passkeys](https://fusionauth.io/docs/apis/webauthn/import-passkeys.md) | `POST` | `/api/webauthn/import` |
| [Start a WebAuthn Passkey Registration](https://fusionauth.io/docs/apis/webauthn/start-a-webauthn-passkey-registration.md) | `POST` | `/api/webauthn/register/start` |
| [Complete a WebAuthn Passkey Registration](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-registration.md) | `POST` | `/api/webauthn/register/complete` |
| [Start a WebAuthn Passkey Assertion or Authentication](https://fusionauth.io/docs/apis/webauthn/start-a-webauthn-passkey-assertion-or-authentication.md) | `POST` | `/api/webauthn/start` |
| [Complete a WebAuthn Passkey Authentication](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-authentication.md) | `POST` | `/api/webauthn/login` |
| [Complete a WebAuthn Passkey Assertion](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-assertion.md) | `POST` | `/api/webauthn/assert` |

## WebAuthn JavaScript API Binary Format[#](#webauthn-javascript-api-binary-format)

The [WebAuthn JavaScript API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) `navigator.credentials.create()` and `navigator.credentials.get()` expect to receive fields containing binary data on the `options` object as a JavaScript [ArrayBuffer](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer) and will return binary fields as `ArrayBuffer`s. In order to prevent encoding issues on the FusionAuth API, these fields are passed over the network as base64url-encoded strings.

Select fields on the `options` JSON object that is passed to the [WebAuthn JavaScript API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) must be converted from base64url-encoded strings to `ArrayBuffer`s after receiving `options` from the FusionAuth API. Likewise, certain fields on [WebAuthn JavaScript API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) responses must be converted from `ArrayBuffer`s to base64url-encoded strings before calling FusionAuth's APIs to complete the ceremony.

### Converting base64url-encoded String to `ArrayBuffer`[#](#converting-base64url-encoded-string-to-arraybuffer)

Converting a base64url-encoded strings to `ArrayBuffer`s is required before the `options` JSON object from [Start a WebAuthn Passkey Registration](https://fusionauth.io/docs/apis/webauthn/start-a-webauthn-passkey-registration.md) or [Start a WebAuthn Passkey Assertion or Authentication](https://fusionauth.io/docs/apis/webauthn/start-a-webauthn-passkey-assertion-or-authentication.md) responses are passed to the [WebAuthn JavaScript API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API). The FusionAuth hosted pages will perform this conversion as necessary. If you need to perform this conversion yourself, you can use the following JavaScript function.

*Function to convert a base64url-encoded string to an ArrayBuffer*

```javascript
function base64URLToBuffer(base64URL) {
  const base64 = base64URL.replace(/-/g, '+').replace(/_/g, '/');
  const padLen = (4 - (base64.length % 4)) % 4;
  return Uint8Array.from(atob(base64.padEnd(base64.length + padLen, '=')), c => c.charCodeAt(0));
}
```

Fields that require this conversion are documented in the [Start a WebAuthn Passkey Registration](https://fusionauth.io/docs/apis/webauthn/start-a-webauthn-passkey-registration.md) and [Start a WebAuthn Passkey Assertion or Authentication](https://fusionauth.io/docs/apis/webauthn/start-a-webauthn-passkey-assertion-or-authentication.md) response sections.

### Converting `ArrayBuffer` to base64url-encoded String[#](#converting-arraybuffer-to-base64url-encoded-string)

Converting `ArrayBuffer`s to base64url-encoded strings is required before the responses from the [WebAuthn JavaScript APIs](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) are sent to FusionAuth's [Complete a WebAuthn Passkey Registration](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-registration.md), [Complete a WebAuthn Passkey Authentication](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-authentication.md), or [Complete a WebAuthn Passkey Assertion](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-assertion.md) APIs. The FusionAuth hosted pages will perform this conversion as necessary. If you need to perform this conversion yourself, you can use the following JavaScript function.

*Function to convert an ArrayBuffer to a base64url-encoded string*

```javascript
function bufferToBase64URL(buffer) {
  const bytes = new Uint8Array(buffer);
  let string = '';
  bytes.forEach(b => string += String.fromCharCode(b));

  const base64 = btoa(string);
  return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
}
```

Fields that require this conversion are documented in the [Complete a WebAuthn Passkey Registration](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-registration.md), [Complete a WebAuthn Passkey Authentication](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-authentication.md), and [Complete a WebAuthn Passkey Assertion](https://fusionauth.io/docs/apis/webauthn/complete-a-webauthn-passkey-assertion.md) request sections.