Webauthn Lib

web-auth/webauthn-lib is a PHP library that implements the FIDO2 and WebAuthn specifications, enabling applications to support passwordless and multi-factor authentication with passkeys and hardware security tokens such as YubiKeys. It handles both credential registration (attestation) and login (assertion), giving you the server-side building blocks to speak WebAuthn with browsers and authenticators.

The library manages the full ceremony flow — generating creation and request options, validating authenticator responses, verifying attestation statements, and persisting public-key credentials — while remaining framework-agnostic. It is the core component of the broader Web Authentication Framework project and is distributed as a read-only subsplit for standalone installation.

What You Get

• Generation of PublicKeyCredentialCreationOptions and RequestOptions for the browser
• Validation of registration (attestation) and authentication (assertion) responses
• Support for multiple attestation formats including packed, TPM, and Apple
• A credential source repository abstraction for persisting public-key credentials
• Metadata service integration for authenticator trust decisions
• A framework-agnostic API usable in Symfony, Laravel, or plain PHP

Common Use Cases

• Adding passkey (passwordless) login to a web application
• Offering hardware security keys as a second factor for MFA
• Registering and managing FIDO2 credentials for user accounts
• Meeting strong-authentication requirements with phishing-resistant credentials

Under The Hood

Architecture - The library models the WebAuthn spec as a set of value objects (PublicKeyCredentialCreationOptions, PublicKeyCredentialRequestOptions, PublicKeyCredentialSource) coordinated by dedicated validators (AuthenticatorAttestationResponseValidator and AuthenticatorAssertionResponseValidator). Attestation is pluggable via an AttestationStatementSupportManager that dispatches to format-specific handlers, and persistence is abstracted behind a PublicKeyCredentialSourceRepository interface the host application implements.

Tech Stack - Pure PHP (100% of the codebase) using PSR-4 autoloading under the Webauthn namespace, targeting modern PHP. It leans on CBOR decoding, COSE key handling, and PSR HTTP interfaces from sibling packages in the web-auth ecosystem, and integrates with the FIDO Metadata Service for authenticator trust.

Code Quality - Maintained primarily by Florent Morselli with a broad contributor base, the code is spec-driven and well structured around clear interfaces, with a substantial test suite in the parent webauthn-framework monorepo. This repository is a read-only subsplit, so issues and pull requests are directed to the main project.

API Design - The API mirrors the WebAuthn ceremony steps closely, which makes it precise but requires familiarity with the specification: you create options, hand them to the browser, then pass the authenticator response to the matching validator. Helper managers reduce boilerplate for attestation and extensions, though initial wiring of repositories and managers is non-trivial.