WebAuthn

WebAuthn (Web Authentication) is a W3C Recommendation that gives browsers a standard JavaScript API for authenticating users with public-key cryptography instead of shared secrets. A user registers an authenticator — a hardware security key, a phone, or a platform biometric like a fingerprint or face — and from then on proves who they are by signing a challenge with a private key that never leaves the device. Together with the FIDO2 CTAP protocol it is the machinery behind passkeys and passwordless login.

• Public-key credentials - The private key stays on the authenticator; the server only ever stores a public key, so there is no password database to breach.
• Phishing resistance - Credentials are bound to a specific origin, so a signature made for a real site cannot be replayed against a lookalike.
• Authenticator variety - Roaming security keys, platform biometrics, and phones acting as authenticators all speak the same API.
• Passkeys - Syncable, discoverable WebAuthn credentials that carry across a user’s devices are what most people now experience as “passkeys.”

For API operations, WebAuthn mostly lives at the human edge — the login and account-recovery flows that front an API program’s developer portal or dashboard. It rarely secures the API calls themselves, which still lean on OAuth tokens and API keys, but it hardens the accounts that mint and manage those credentials. As agentic access grows, WebAuthn draws a useful line: strong human presence at the moments that matter — enrolling a device, authorizing a delegation — while machine-to-machine traffic continues to ride token-based standards downstream.