Server-side passkey authentication | Authentication

<!doctype html> <html lang="en" dir="ltr"> <head> <meta name="google-signin-client-id" content="721724668570-nbkv1cfusk7kk4eni4pjvepaus73b13t.apps.googleusercontent.com"> <meta name="google-signin-scope" content="profile email https://www.googleapis.com/auth/developerprofiles https://www.googleapis.com/auth/developerprofiles.award"> <meta property="og:site_name" content="Google for Developers"> <meta property="og:type" content="website"><meta name="theme-color" content="#009688"><meta charset="utf-8"> <meta content="IE=Edge" http-equiv="X-UA-Compatible"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="manifest" href="/_pwa/developers/manifest.json" crossorigin="use-credentials"> <link rel="preconnect" href="//www.gstatic.com" crossorigin> <link rel="preconnect" href="//fonts.gstatic.com" crossorigin> <link rel="preconnect" href="//fonts.googleapis.com" crossorigin> <link rel="preconnect" href="//apis.google.com" crossorigin> <link rel="preconnect" href="//www.google-analytics.com" crossorigin><link rel="stylesheet" href="//fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"> <link rel="stylesheet" href="//fonts.googleapis.com/css2?family=Material+Icons&family=Material+Symbols+Outlined&display=block"><link rel="stylesheet" href="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/css/app.css"> <link rel="shortcut icon" href="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/favicon-new.png"> <link rel="apple-touch-icon" href="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/touchicon-180-new.png"><link rel="canonical" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication"><link rel="search" type="application/opensearchdescription+xml" title="Google for Developers" href="https://developers.google.com/s/opensearch.xml"> <link rel="alternate" hreflang="en" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication" /><link rel="alternate" hreflang="x-default" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication" /><link rel="alternate" hreflang="ar" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=ar" /><link rel="alternate" hreflang="bn" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=bn" /><link rel="alternate" hreflang="zh-Hans" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=zh-cn" /><link rel="alternate" hreflang="zh-Hant" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=zh-tw" /><link rel="alternate" hreflang="fa" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=fa" /><link rel="alternate" hreflang="fr" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=fr" /><link rel="alternate" hreflang="de" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=de" /><link rel="alternate" hreflang="he" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=he" /><link rel="alternate" hreflang="hi" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=hi" /><link rel="alternate" hreflang="id" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=id" /><link rel="alternate" hreflang="it" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=it" /><link rel="alternate" hreflang="ja" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=ja" /><link rel="alternate" hreflang="ko" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=ko" /><link rel="alternate" hreflang="pl" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=pl" /><link rel="alternate" hreflang="pt-BR" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=pt-br" /><link rel="alternate" hreflang="ru" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=ru" /><link rel="alternate" hreflang="es-419" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=es-419" /><link rel="alternate" hreflang="th" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=th" /><link rel="alternate" hreflang="tr" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=tr" /><link rel="alternate" hreflang="vi" href="https://developers.google.com/identity/passkeys/developer-guides/server-authentication?hl=vi" /><title>Server-side passkey authentication  |  Authentication  |  Google for Developers</title> <meta property="og:title" content="Server-side passkey authentication  |  Authentication  |  Google for Developers"><meta property="og:url" content="https://developers.google.com/identity/passkeys/developer-guides/server-authentication"><meta property="og:image" content="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/opengraph/teal.png"> <meta property="og:image:width" content="1200"> <meta property="og:image:height" content="675"><meta property="og:locale" content="en"><meta name="twitter:card" content="summary_large_image"><script type="application/ld+json"> { "@context": "https://schema.org", "@type": "Article", "headline": "Server-side passkey authentication" } </script><script type="application/ld+json"> { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [{ "@type": "ListItem", "position": 1, "name": "Google Identity", "item": "https://developers.google.com/identity" },{ "@type": "ListItem", "position": 2, "name": "Authentication", "item": "https://developers.google.com/identity/authentication" },{ "@type": "ListItem", "position": 3, "name": "Server-side passkey authentication", "item": "https://developers.google.com/identity/passkeys/developer-guides/server-authentication" }] } </script> <link rel="stylesheet" href="/extras.css"></head> <body class="" template="page" theme="teal" type="article" layout="docs" concierge='closed' display-toc pending> <devsite-progress type="indeterminate" id="app-progress"></devsite-progress> <a href="#main-content" class="skip-link button"> Skip to main content </a> <section class="devsite-wrapper"> <devsite-cookie-notification-bar></devsite-cookie-notification-bar><devsite-header role="banner"> <div class="devsite-header--inner nocontent"> <div class="devsite-top-logo-row-wrapper-wrapper"> <div class="devsite-top-logo-row-wrapper"> <div class="devsite-top-logo-row"> <button type="button" id="devsite-hamburger-menu" class="devsite-header-icon-button button-flat material-icons gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Navigation menu button" visually-hidden aria-label="Open menu"> </button> <div class="devsite-product-name-wrapper"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item devsite-has-google-wordmark"> <a href="https://developers.google.com/identity" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Upper Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="Google Identity" > <svg class="devsite-google-wordmark" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 148 48"> <title>Google</title> <path class="devsite-google-wordmark-svg-path" d="M19.58,37.65c-9.87,0-18.17-8.04-18.17-17.91c0-9.87,8.3-17.91,18.17-17.91c5.46,0,9.35,2.14,12.27,4.94l-3.45,3.45c-2.1-1.97-4.93-3.49-8.82-3.49c-7.21,0-12.84,5.81-12.84,13.02c0,7.21,5.64,13.02,12.84,13.02c4.67,0,7.34-1.88,9.04-3.58c1.4-1.4,2.32-3.41,2.66-6.16H19.58v-4.89h16.47c0.18,0.87,0.26,1.92,0.26,3.06c0,3.67-1.01,8.21-4.24,11.44C28.93,35.9,24.91,37.65,19.58,37.65z M61.78,26.12c0,6.64-5.1,11.53-11.36,11.53s-11.36-4.89-11.36-11.53c0-6.68,5.1-11.53,11.36-11.53S61.78,19.43,61.78,26.12z M56.8,26.12c0-4.15-2.96-6.99-6.39-6.99c-3.43,0-6.39,2.84-6.39,6.99c0,4.11,2.96,6.99,6.39,6.99C53.84,33.11,56.8,30.22,56.8,26.12z M87.25,26.12c0,6.64-5.1,11.53-11.36,11.53c-6.26,0-11.36-4.89-11.36-11.53c0-6.68,5.1-11.53,11.36-11.53C82.15,14.59,87.25,19.43,87.25,26.12zM82.28,26.12c0-4.15-2.96-6.99-6.39-6.99c-3.43,0-6.39,2.84-6.39,6.99c0,4.11,2.96,6.99,6.39,6.99C79.32,33.11,82.28,30.22,82.28,26.12z M112.09,15.29v20.7c0,8.52-5.02,12.01-10.96,12.01c-5.59,0-8.95-3.76-10.22-6.81l4.41-1.83c0.79,1.88,2.71,4.1,5.81,4.1c3.8,0,6.16-2.36,6.16-6.77v-1.66h-0.18c-1.14,1.4-3.32,2.62-6.07,2.62c-5.76,0-11.05-5.02-11.05-11.49c0-6.51,5.28-11.57,11.05-11.57c2.75,0,4.93,1.22,6.07,2.58h0.18v-1.88H112.09z M107.64,26.16c0-4.06-2.71-7.03-6.16-7.03c-3.49,0-6.42,2.97-6.42,7.03c0,4.02,2.93,6.94,6.42,6.94C104.93,33.11,107.64,30.18,107.64,26.16z M120.97,3.06v33.89h-5.07V3.06H120.97z M140.89,29.92l3.93,2.62c-1.27,1.88-4.32,5.11-9.61,5.11c-6.55,0-11.28-5.07-11.28-11.53c0-6.86,4.77-11.53,10.71-11.53c5.98,0,8.91,4.76,9.87,7.34l0.52,1.31l-15.42,6.38c1.18,2.31,3.01,3.49,5.59,3.49C137.79,33.11,139.58,31.84,140.89,29.92zM128.79,25.77l10.31-4.28c-0.57-1.44-2.27-2.45-4.28-2.45C132.24,19.04,128.66,21.31,128.79,25.77z"/> </svg>Identity </a> </li> </ul> </div> <div class="devsite-top-logo-row-middle"> <div class="devsite-header-upper-tabs"> <devsite-tabs class="upper-tabs"> <nav class="devsite-tabs-wrapper" aria-label="Upper tabs"> <tab class="devsite-dropdown devsite-active "> <a href="https://developers.google.com/identity/authentication" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/authentication" track-type="nav" track-metadata-position="nav - authentication" track-metadata-module="primary nav" aria-label="Authentication, selected" data-category="Site-Wide Custom Events" data-label="Tab: Authentication" track-name="authentication" > Authentication </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Authentication" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/authentication" track-metadata-position="nav - authentication" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Authentication" track-name="authentication" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Sign In with Google SDKs</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/android-credential-manager" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/android-credential-manager" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> Credential Manager for Android </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/gsi/web/guides/overview" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/gsi/web/guides/overview" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> Sign In with Google for Web (including One Tap) </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/sign-in/ios/start" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/sign-in/ios/start" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> Google Sign-In for iOS and macOS </div> </a> </li> </ul> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Industry standards</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/passkeys" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/passkeys" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> Passkeys </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/openid-connect/openid-connect" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/openid-connect/openid-connect" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> OpenID Connect </div> </a> </li> </ul> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Legacy Sign In</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/one-tap/android/overview" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/one-tap/android/overview" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> One Tap sign-up/sign-in for Android </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/sign-in/android/legacy-start-integrating" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/sign-in/android/legacy-start-integrating" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> Google Sign-In for Android </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/sign-in/web/sign-in" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/sign-in/web/sign-in" track-metadata-position="nav - authentication" track-metadata-module="tertiary nav" track-metadata-module_headline="sign in with google sdks" tooltip > <div class="devsite-nav-item-title"> Google Sign-In for Web </div> </a> </li> </ul> </div> </div> </div> </tab> <tab class="devsite-dropdown "> <a href="https://developers.google.com/identity/authorization" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/authorization" track-type="nav" track-metadata-position="nav - authorization" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Authorization" track-name="authorization" > Authorization </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Authorization" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/authorization" track-metadata-position="nav - authorization" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Authorization" track-name="authorization" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Call Google APIs</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/sign-in/android/authorize-access" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/sign-in/android/authorize-access" track-metadata-position="nav - authorization" track-metadata-module="tertiary nav" track-metadata-module_headline="call google apis" tooltip > <div class="devsite-nav-item-title"> Authorizing for Android </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/oauth2/web/guides/overview" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/oauth2/web/guides/overview" track-metadata-position="nav - authorization" track-metadata-module="tertiary nav" track-metadata-module_headline="call google apis" tooltip > <div class="devsite-nav-item-title"> Authorizing for Web </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/sign-in/ios/api-access" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/sign-in/ios/api-access" track-metadata-position="nav - authorization" track-metadata-module="tertiary nav" track-metadata-module_headline="call google apis" tooltip > <div class="devsite-nav-item-title"> Authorizing for iOS/macOS </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/protocols/oauth2" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/protocols/oauth2" track-metadata-position="nav - authorization" track-metadata-module="tertiary nav" track-metadata-module_headline="call google apis" tooltip > <div class="devsite-nav-item-title"> Using OAuth 2.0 </div> </a> </li> </ul> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Share data with Google apps and devices</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/account-linking" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/account-linking" track-metadata-position="nav - authorization" track-metadata-module="tertiary nav" track-metadata-module_headline="call google apis" tooltip > <div class="devsite-nav-item-title"> Google Account Linking </div> </a> </li> </ul> </div> </div> </div> </tab> <tab class="devsite-dropdown "> <a href="https://developers.google.com/identity/credential-management" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/credential-management" track-type="nav" track-metadata-position="nav - credential management" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Credential management" track-name="credential management" > Credential management </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Credential management" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/credential-management" track-metadata-position="nav - credential management" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Credential management" track-name="credential management" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Android</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/android-credential-manager" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/android-credential-manager" track-metadata-position="nav - credential management" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Credential Manager </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/blockstore/android" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/blockstore/android" track-metadata-position="nav - credential management" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Blockstore </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/smartlock-passwords/android/associate-apps-and-sites" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/smartlock-passwords/android/associate-apps-and-sites" track-metadata-position="nav - credential management" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Digital Asset Links </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developer.android.com/guide/topics/text/autofill" track-type="nav" track-metadata-eventdetail="https://developer.android.com/guide/topics/text/autofill" track-metadata-position="nav - credential management" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Android autofill framework </div> </a> </li> </ul> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Web</li> <li class="devsite-nav-item"> <a href="https://web.dev/sign-in-form-best-practices/" track-type="nav" track-metadata-eventdetail="https://web.dev/sign-in-form-best-practices/" track-metadata-position="nav - credential management" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Autocomplete </div> </a> </li> </ul> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Cross-platform</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/credential-sharing" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/credential-sharing" track-metadata-position="nav - credential management" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Seamless credential sharing </div> </a> </li> </ul> </div> </div> </div> </tab> <tab class="devsite-dropdown "> <a href="https://developers.google.com/identity/credential-verification" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/credential-verification" track-type="nav" track-metadata-position="nav - credential verification" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Credential verification" track-name="credential verification" > Credential verification </a> <button aria-haspopup="menu" aria-expanded="false" aria-label="Dropdown menu for Credential verification" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/credential-verification" track-metadata-position="nav - credential verification" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Credential verification" track-name="credential verification" class="devsite-tabs-dropdown-toggle devsite-icon devsite-icon-arrow-drop-down"></button> <div class="devsite-tabs-dropdown" role="menu" aria-label="submenu" hidden> <div class="devsite-tabs-dropdown-content"> <div class="devsite-tabs-dropdown-column "> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Android</li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/sms-retriever/overview" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/sms-retriever/overview" track-metadata-position="nav - credential verification" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Verify users by SMS </div> </a> </li> <li class="devsite-nav-item"> <a href="https://developers.google.com/identity/phone-number-hint/android" track-type="nav" track-metadata-eventdetail="https://developers.google.com/identity/phone-number-hint/android" track-metadata-position="nav - credential verification" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Phone Number Hint </div> </a> </li> </ul> <ul class="devsite-tabs-dropdown-section "> <li class="devsite-nav-title" role="heading" tooltip>Web</li> <li class="devsite-nav-item"> <a href="https://web.dev/web-otp/" track-type="nav" track-metadata-eventdetail="https://web.dev/web-otp/" track-metadata-position="nav - credential verification" track-metadata-module="tertiary nav" track-metadata-module_headline="android" tooltip > <div class="devsite-nav-item-title"> Verify phone numbers on the web </div> </a> </li> </ul> </div> </div> </div> </tab> </nav> </devsite-tabs> </div> <devsite-search enable-signin enable-search enable-suggestions enable-query-completion project-name="Authentication" tenant-name="Google for Developers" project-scope="/identity/authentication" url-scoped="https://developers.google.com/s/results/identity/authentication" > <form class="devsite-search-form" action="https://developers.google.com/s/results" method="GET"> <div class="devsite-search-container"> <button type="button" search-open class="devsite-search-button devsite-header-icon-button button-flat material-icons" aria-label="Open search"></button> <div class="devsite-searchbox"> <input aria-activedescendant="" aria-autocomplete="list" aria-label="Search" aria-expanded="false" aria-haspopup="listbox" autocomplete="off" class="devsite-search-field devsite-search-query" name="q" placeholder="Search" role="combobox" type="text" value="" > <div class="devsite-search-image material-icons" aria-hidden="true"> </div> <div class="devsite-search-shortcut-icon-container" aria-hidden="true"> <kbd class="devsite-search-shortcut-icon">/</kbd> </div> </div> </div> </form> <button type="button" search-close class="devsite-search-button devsite-header-icon-button button-flat material-icons" aria-label="Close search"></button> </devsite-search> </div> <devsite-language-selector> <ul role="presentation"> <li role="presentation"> <a role="menuitem" lang="en" >English</a> </li> <li role="presentation"> <a role="menuitem" lang="de" >Deutsch</a> </li> <li role="presentation"> <a role="menuitem" lang="es" >Español</a> </li> <li role="presentation"> <a role="menuitem" lang="es_419" >Español – América Latina</a> </li> <li role="presentation"> <a role="menuitem" lang="fr" >Français</a> </li> <li role="presentation"> <a role="menuitem" lang="id" >Indonesia</a> </li> <li role="presentation"> <a role="menuitem" lang="it" >Italiano</a> </li> <li role="presentation"> <a role="menuitem" lang="pl" >Polski</a> </li> <li role="presentation"> <a role="menuitem" lang="pt_br" >Português – Brasil</a> </li> <li role="presentation"> <a role="menuitem" lang="vi" >Tiếng Việt</a> </li> <li role="presentation"> <a role="menuitem" lang="tr" >Türkçe</a> </li> <li role="presentation"> <a role="menuitem" lang="ru" >Русский</a> </li> <li role="presentation"> <a role="menuitem" lang="he" >עברית</a> </li> <li role="presentation"> <a role="menuitem" lang="ar" >العربيّة</a> </li> <li role="presentation"> <a role="menuitem" lang="fa" >فارسی</a> </li> <li role="presentation"> <a role="menuitem" lang="hi" >हिंदी</a> </li> <li role="presentation"> <a role="menuitem" lang="bn" >বাংলা</a> </li> <li role="presentation"> <a role="menuitem" lang="th" >ภาษาไทย</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_cn" >中文 – 简体</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_tw" >中文 – 繁體</a> </li> <li role="presentation"> <a role="menuitem" lang="ja" >日本語</a> </li> <li role="presentation"> <a role="menuitem" lang="ko" >한국어</a> </li> </ul> </devsite-language-selector> <devsite-user enable-profiles fp-auth id="devsite-user"> Sign in </devsite-user> </div> </div> </div> <div class="devsite-collapsible-section "> <div class="devsite-header-background"> <div class="devsite-product-id-row" > <div class="devsite-product-description-row"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item "> <a href="https://developers.google.com/identity/authentication" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Lower Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="Authentication" > Authentication </a> </li> </ul> </div> </div> <div class="devsite-doc-set-nav-row"> <devsite-tabs class="lower-tabs"> <nav class="devsite-tabs-wrapper" aria-label="Lower tabs"> <tab > <a href="https://developers.google.com/identity/android-credential-manager" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/android-credential-manager" track-type="nav" track-metadata-position="nav - credential manager for android" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Credential Manager for Android" track-name="credential manager for android" > Credential Manager for Android </a> </tab> <tab > <a href="https://developers.google.com/identity/gsi/web/guides/overview" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/gsi/web/guides/overview" track-type="nav" track-metadata-position="nav - sign in with google for web" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Sign In with Google for Web" track-name="sign in with google for web" > Sign In with Google for Web </a> </tab> <tab > <a href="https://developers.google.com/identity/sign-in/ios/start-integrating" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/sign-in/ios/start-integrating" track-type="nav" track-metadata-position="nav - google sign-in for ios and macos" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: Google Sign-In for iOS and macOS" track-name="google sign-in for ios and macos" > Google Sign-In for iOS and macOS </a> </tab> <tab class="devsite-active"> <a href="https://developers.google.com/identity/passkeys" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/passkeys" track-type="nav" track-metadata-position="nav - passkeys" track-metadata-module="primary nav" aria-label="Passkeys, selected" data-category="Site-Wide Custom Events" data-label="Tab: Passkeys" track-name="passkeys" > Passkeys </a> </tab> <tab > <a href="https://developers.google.com/identity/openid-connect/openid-connect" class="devsite-tabs-content gc-analytics-event " track-metadata-eventdetail="https://developers.google.com/identity/openid-connect/openid-connect" track-type="nav" track-metadata-position="nav - openid connect" track-metadata-module="primary nav" data-category="Site-Wide Custom Events" data-label="Tab: OpenID Connect" track-name="openid connect" > OpenID Connect </a> </tab> </nav> </devsite-tabs> </div> </div> </div> </div> </devsite-header> <devsite-book-nav scrollbars > <div class="devsite-book-nav-filter" > <input type="text" placeholder="Filter" aria-label="Type to filter" role="searchbox"> </div> <nav class="devsite-book-nav devsite-nav nocontent" aria-label="Side menu"> <div class="devsite-mobile-header"> <button type="button" id="devsite-close-nav" class="devsite-header-icon-button button-flat material-icons gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Close navigation" aria-label="Close navigation"> </button> <div class="devsite-product-name-wrapper"> <ul class="devsite-breadcrumb-list" > <li class="devsite-breadcrumb-item devsite-has-google-wordmark"> <a href="https://developers.google.com/identity" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Upper Header" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="Google Identity" > <svg class="devsite-google-wordmark" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 148 48"> <title>Google</title> <path class="devsite-google-wordmark-svg-path" d="M19.58,37.65c-9.87,0-18.17-8.04-18.17-17.91c0-9.87,8.3-17.91,18.17-17.91c5.46,0,9.35,2.14,12.27,4.94l-3.45,3.45c-2.1-1.97-4.93-3.49-8.82-3.49c-7.21,0-12.84,5.81-12.84,13.02c0,7.21,5.64,13.02,12.84,13.02c4.67,0,7.34-1.88,9.04-3.58c1.4-1.4,2.32-3.41,2.66-6.16H19.58v-4.89h16.47c0.18,0.87,0.26,1.92,0.26,3.06c0,3.67-1.01,8.21-4.24,11.44C28.93,35.9,24.91,37.65,19.58,37.65z M61.78,26.12c0,6.64-5.1,11.53-11.36,11.53s-11.36-4.89-11.36-11.53c0-6.68,5.1-11.53,11.36-11.53S61.78,19.43,61.78,26.12z M56.8,26.12c0-4.15-2.96-6.99-6.39-6.99c-3.43,0-6.39,2.84-6.39,6.99c0,4.11,2.96,6.99,6.39,6.99C53.84,33.11,56.8,30.22,56.8,26.12z M87.25,26.12c0,6.64-5.1,11.53-11.36,11.53c-6.26,0-11.36-4.89-11.36-11.53c0-6.68,5.1-11.53,11.36-11.53C82.15,14.59,87.25,19.43,87.25,26.12zM82.28,26.12c0-4.15-2.96-6.99-6.39-6.99c-3.43,0-6.39,2.84-6.39,6.99c0,4.11,2.96,6.99,6.39,6.99C79.32,33.11,82.28,30.22,82.28,26.12z M112.09,15.29v20.7c0,8.52-5.02,12.01-10.96,12.01c-5.59,0-8.95-3.76-10.22-6.81l4.41-1.83c0.79,1.88,2.71,4.1,5.81,4.1c3.8,0,6.16-2.36,6.16-6.77v-1.66h-0.18c-1.14,1.4-3.32,2.62-6.07,2.62c-5.76,0-11.05-5.02-11.05-11.49c0-6.51,5.28-11.57,11.05-11.57c2.75,0,4.93,1.22,6.07,2.58h0.18v-1.88H112.09z M107.64,26.16c0-4.06-2.71-7.03-6.16-7.03c-3.49,0-6.42,2.97-6.42,7.03c0,4.02,2.93,6.94,6.42,6.94C104.93,33.11,107.64,30.18,107.64,26.16z M120.97,3.06v33.89h-5.07V3.06H120.97z M140.89,29.92l3.93,2.62c-1.27,1.88-4.32,5.11-9.61,5.11c-6.55,0-11.28-5.07-11.28-11.53c0-6.86,4.77-11.53,10.71-11.53c5.98,0,8.91,4.76,9.87,7.34l0.52,1.31l-15.42,6.38c1.18,2.31,3.01,3.49,5.59,3.49C137.79,33.11,139.58,31.84,140.89,29.92zM128.79,25.77l10.31-4.28c-0.57-1.44-2.27-2.45-4.28-2.45C132.24,19.04,128.66,21.31,128.79,25.77z"/> </svg>Identity </a> </li> </ul> </div> </div> <div class="devsite-book-nav-wrapper"> <div class="devsite-mobile-nav-top"> <ul class="devsite-nav-list"> <li class="devsite-nav-item"> <a href="/identity/authentication" class="devsite-nav-title gc-analytics-event devsite-nav-active" data-category="Site-Wide Custom Events" data-label="Tab: Authentication" track-name="authentication" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Authentication" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Authentication </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> <ul class="devsite-nav-responsive-tabs"> <li class="devsite-nav-item"> <a href="/identity/android-credential-manager" class="devsite-nav-title gc-analytics-event devsite-nav-has-children " data-category="Site-Wide Custom Events" data-label="Tab: Credential Manager for Android" track-name="credential manager for android" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Credential Manager for Android" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Credential Manager for Android </a> </li> <li class="devsite-nav-item"> <a href="/identity/gsi/web/guides/overview" class="devsite-nav-title gc-analytics-event devsite-nav-has-children " data-category="Site-Wide Custom Events" data-label="Tab: Sign In with Google for Web" track-name="sign in with google for web" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Sign In with Google for Web" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Sign In with Google for Web </a> </li> <li class="devsite-nav-item"> <a href="/identity/sign-in/ios/start-integrating" class="devsite-nav-title gc-analytics-event devsite-nav-has-children " data-category="Site-Wide Custom Events" data-label="Tab: Google Sign-In for iOS and macOS" track-name="google sign-in for ios and macos" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Sign-In for iOS and macOS" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Sign-In for iOS and macOS </a> </li> <li class="devsite-nav-item"> <a href="/identity/passkeys" class="devsite-nav-title gc-analytics-event devsite-nav-has-children devsite-nav-active" data-category="Site-Wide Custom Events" data-label="Tab: Passkeys" track-name="passkeys" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Passkeys" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Passkeys </a> </li> <li class="devsite-nav-item"> <a href="/identity/openid-connect/openid-connect" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: OpenID Connect" track-name="openid connect" data-category="Site-Wide Custom Events" data-label="Responsive Tab: OpenID Connect" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> OpenID Connect </a> </li> </ul> </li> <li class="devsite-nav-item"> <a href="/identity/authorization" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Authorization" track-name="authorization" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Authorization" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Authorization </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> </li> <li class="devsite-nav-item"> <a href="/identity/credential-management" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Credential management" track-name="credential management" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Credential management" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Credential management </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> </li> <li class="devsite-nav-item"> <a href="/identity/credential-verification" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Tab: Credential verification" track-name="credential verification" data-category="Site-Wide Custom Events" data-label="Responsive Tab: Credential verification" track-type="globalNav" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Credential verification </a> <ul class="devsite-nav-responsive-tabs devsite-nav-has-menu "> <li class="devsite-nav-item"> More </li> </ul> </li> </ul> </div> <div class="devsite-mobile-nav-bottom"> <ul class="devsite-nav-list" menu="_book"> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> Passkeys </div></li> <li class="devsite-nav-item"><a href="/identity/passkeys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys" >Overview</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/supported-environments" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/supported-environments" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/supported-environments" >Supported environments</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/use-cases" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/use-cases" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/use-cases" >Use cases</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/faq" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/faq" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/faq" >FAQ</a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> Developer guides </div></li> <li class="devsite-nav-item"><a href="/identity/passkeys/developer-guides" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/developer-guides" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/developer-guides" >Overview</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/developer-guides/server-introduction" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/developer-guides/server-introduction" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/developer-guides/server-introduction" >Server-side introduction</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/developer-guides/server-registration" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/developer-guides/server-registration" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/developer-guides/server-registration" >Server-side registration</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/developer-guides/server-authentication" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/developer-guides/server-authentication" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/developer-guides/server-authentication" >Server-side authentication</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/webauthn-user-verification" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/webauthn-user-verification" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/webauthn-user-verification" >User verification deep dive</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/webauthn-discoverable-credentials" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/webauthn-discoverable-credentials" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/webauthn-discoverable-credentials" >Discoverable credentials deep dive</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/webauthn-exclude-credentials" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/webauthn-exclude-credentials" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/webauthn-exclude-credentials" >Prevent duplicate credentials</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/webauthn-aaguid" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/webauthn-aaguid" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/webauthn-aaguid" >Determine the passkey provider</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/webauthn-related-origin-requests" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/webauthn-related-origin-requests" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/webauthn-related-origin-requests" >Associate related origins</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://developer.chrome.com/docs/identity/webauthn-signal-api" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://developer.chrome.com/docs/identity/webauthn-signal-api" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://developer.chrome.com/docs/identity/webauthn-signal-api" >Keep passkeys consistent with the server</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/developer-guides/upgrades" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/developer-guides/upgrades" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/developer-guides/upgrades" >Passkeys upgrades</a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> Integration guide for the web </div></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/passkey-registration/" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/passkey-registration/" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/passkey-registration/" >Create a passkey on the web</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/passkey-form-autofill/" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/passkey-form-autofill/" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/passkey-form-autofill/" >Sign in with a passkey on the web</a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> Integration guide for Android apps </div></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://developer.android.com/training/sign-in/passkeys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://developer.android.com/training/sign-in/passkeys" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://developer.android.com/training/sign-in/passkeys" >Credential Manager overview</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://medium.com/androiddevelopers/bringing-seamless-authentication-to-your-apps-using-credential-manager-api-b3f0d09e0093" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://medium.com/androiddevelopers/bringing-seamless-authentication-to-your-apps-using-credential-manager-api-b3f0d09e0093" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://medium.com/androiddevelopers/bringing-seamless-authentication-to-your-apps-using-credential-manager-api-b3f0d09e0093" >Integrate passkeys using Credential Manager</a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> User experience guidelines </div></li> <li class="devsite-nav-item"><a href="/identity/passkeys/ux/user-journeys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/ux/user-journeys" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/ux/user-journeys" >Passkeys user journeys</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/ux/communicating-passkeys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/ux/communicating-passkeys" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/ux/communicating-passkeys" >Communicating passkeys to users</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/ux/user-interface-design" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/ux/user-interface-design" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/ux/user-interface-design" >Passkeys user interface design</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://developer.android.com/design/ui/mobile/guides/patterns/passkeys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://developer.android.com/design/ui/mobile/guides/patterns/passkeys" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://developer.android.com/design/ui/mobile/guides/patterns/passkeys" >User experience design for Android</a></li> <li class="devsite-nav-item devsite-nav-heading"><div class="devsite-nav-title devsite-nav-title-no-path"> Case studies </div></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://developers.googleblog.com/2023/10/how-kayak-reduced-sign-in-time-and-improved-security-with-passkeys.html" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://developers.googleblog.com/2023/10/how-kayak-reduced-sign-in-time-and-improved-security-with-passkeys.html" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://developers.googleblog.com/2023/10/how-kayak-reduced-sign-in-time-and-improved-security-with-passkeys.html" >How KAYAK reduced sign in time by 50% and improved security with passkeys</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/case-studies/yahoo-japan-passkeys" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/case-studies/yahoo-japan-passkeys" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/case-studies/yahoo-japan-passkeys" >How Yahoo! JAPAN increased passkeys adoption to 11% and reduced SMS OTP costs</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/case-studies/dashlane" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/case-studies/dashlane" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/case-studies/dashlane" >Dashlane sees 70% increase in conversion rate for signing-in with passkeys</a></li> <li class="devsite-nav-item"><a href="/identity/passkeys/case-studies/mercari" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: /identity/passkeys/case-studies/mercari" track-type="bookNav" track-name="click" track-metadata-eventdetail="/identity/passkeys/case-studies/mercari" >Mercari’s passkey authentication speeds up sign-in 3.9 times</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://web.dev/articles/passkey-google-ux" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://web.dev/articles/passkey-google-ux" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://web.dev/articles/passkey-google-ux" >Designing the user experience of passkeys on Google accounts</a></li> <li class="devsite-nav-item devsite-nav-external"><a href="https://security.googleblog.com/2023/05/making-authentication-faster-than-ever.html" class="devsite-nav-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Book nav link, pathname: https://security.googleblog.com/2023/05/making-authentication-faster-than-ever.html" track-type="bookNav" track-name="click" track-metadata-eventdetail="https://security.googleblog.com/2023/05/making-authentication-faster-than-ever.html" >Making authentication faster than ever: passkeys vs passwords</a></li> </ul> <ul class="devsite-nav-list" menu="Authentication" aria-label="Side menu" hidden> <li class="devsite-nav-item devsite-nav-heading"> Sign In with Google SDKs </li> <li class="devsite-nav-item"> <a href="/identity/android-credential-manager" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Credential Manager for Android" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Credential Manager for Android </a> </li> <li class="devsite-nav-item"> <a href="/identity/gsi/web/guides/overview" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Sign In with Google for Web (including One Tap)" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Sign In with Google for Web (including One Tap) </a> </li> <li class="devsite-nav-item"> <a href="/identity/sign-in/ios/start" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Sign-In for iOS and macOS" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Sign-In for iOS and macOS </a> </li> <li class="devsite-nav-item devsite-nav-heading"> Industry standards </li> <li class="devsite-nav-item"> <a href="/identity/passkeys" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Passkeys" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Passkeys </a> </li> <li class="devsite-nav-item"> <a href="/identity/openid-connect/openid-connect" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: OpenID Connect" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> OpenID Connect </a> </li> <li class="devsite-nav-item devsite-nav-heading"> Legacy Sign In </li> <li class="devsite-nav-item"> <a href="/identity/one-tap/android/overview" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: One Tap sign-up/sign-in for Android" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> One Tap sign-up/sign-in for Android </a> </li> <li class="devsite-nav-item"> <a href="/identity/sign-in/android/legacy-start-integrating" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Sign-In for Android" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Sign-In for Android </a> </li> <li class="devsite-nav-item"> <a href="/identity/sign-in/web/sign-in" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Sign-In for Web" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Sign-In for Web </a> </li> </ul> <ul class="devsite-nav-list" menu="Authorization" aria-label="Side menu" hidden> <li class="devsite-nav-item devsite-nav-heading"> Call Google APIs </li> <li class="devsite-nav-item"> <a href="/identity/sign-in/android/authorize-access" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Authorizing for Android" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Authorizing for Android </a> </li> <li class="devsite-nav-item"> <a href="/identity/oauth2/web/guides/overview" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Authorizing for Web" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Authorizing for Web </a> </li> <li class="devsite-nav-item"> <a href="/identity/sign-in/ios/api-access" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Authorizing for iOS/macOS" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Authorizing for iOS/macOS </a> </li> <li class="devsite-nav-item"> <a href="/identity/protocols/oauth2" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Using OAuth 2.0" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Using OAuth 2.0 </a> </li> <li class="devsite-nav-item devsite-nav-heading"> Share data with Google apps and devices </li> <li class="devsite-nav-item"> <a href="/identity/account-linking" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Google Account Linking" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Google Account Linking </a> </li> </ul> <ul class="devsite-nav-list" menu="Credential management" aria-label="Side menu" hidden> <li class="devsite-nav-item devsite-nav-heading"> Android </li> <li class="devsite-nav-item"> <a href="/identity/android-credential-manager" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Credential Manager" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Credential Manager </a> </li> <li class="devsite-nav-item"> <a href="/identity/blockstore/android" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Blockstore" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Blockstore </a> </li> <li class="devsite-nav-item"> <a href="/identity/smartlock-passwords/android/associate-apps-and-sites" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Digital Asset Links" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Digital Asset Links </a> </li> <li class="devsite-nav-item"> <a href="https://developer.android.com/guide/topics/text/autofill" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Android autofill framework" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Android autofill framework </a> </li> <li class="devsite-nav-item devsite-nav-heading"> Web </li> <li class="devsite-nav-item"> <a href="https://web.dev/sign-in-form-best-practices/" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Autocomplete" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Autocomplete </a> </li> <li class="devsite-nav-item devsite-nav-heading"> Cross-platform </li> <li class="devsite-nav-item"> <a href="/identity/credential-sharing" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Seamless credential sharing" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Seamless credential sharing </a> </li> </ul> <ul class="devsite-nav-list" menu="Credential verification" aria-label="Side menu" hidden> <li class="devsite-nav-item devsite-nav-heading"> Android </li> <li class="devsite-nav-item"> <a href="/identity/sms-retriever/overview" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Verify users by SMS" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Verify users by SMS </a> </li> <li class="devsite-nav-item"> <a href="/identity/phone-number-hint/android" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Phone Number Hint" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Phone Number Hint </a> </li> <li class="devsite-nav-item devsite-nav-heading"> Web </li> <li class="devsite-nav-item"> <a href="https://web.dev/web-otp/" class="devsite-nav-title gc-analytics-event " data-category="Site-Wide Custom Events" data-label="Responsive Tab: Verify phone numbers on the web" track-type="navMenu" track-metadata-eventDetail="globalMenu" track-metadata-position="nav"> Verify phone numbers on the web </a> </li> </ul> </div> </div> </nav> </devsite-book-nav> <section id="gc-wrapper"> <main role="main" id="main-content" class="devsite-main-content" has-book-nav > <devsite-content> <article class="devsite-article"> <div class="devsite-article-meta nocontent" role="navigation"> <ul class="devsite-breadcrumb-list" aria-label="Breadcrumb"> <li class="devsite-breadcrumb-item "> <a href="https://developers.google.com/" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="1" track-type="globalNav" track-name="breadcrumb" track-metadata-position="1" track-metadata-eventdetail="" > Home </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://developers.google.com/products" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="2" track-type="globalNav" track-name="breadcrumb" track-metadata-position="2" track-metadata-eventdetail="" > Products </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://developers.google.com/identity" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="3" track-type="globalNav" track-name="breadcrumb" track-metadata-position="3" track-metadata-eventdetail="Google Identity" > Google Identity </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://developers.google.com/identity/authentication" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="4" track-type="globalNav" track-name="breadcrumb" track-metadata-position="4" track-metadata-eventdetail="Authentication" > Authentication </a> </li> <li class="devsite-breadcrumb-item "> <div class="devsite-breadcrumb-guillemet material-icons" aria-hidden="true"></div> <a href="https://developers.google.com/identity/passkeys" class="devsite-breadcrumb-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Breadcrumbs" data-value="5" track-type="globalNav" track-name="breadcrumb" track-metadata-position="5" track-metadata-eventdetail="" > Passkeys </a> </li> </ul> <devsite-thumb-rating position="header"> </devsite-thumb-rating> </div> <devsite-feedback position="header" project-name="Authentication" product-id="5186570" bucket="Identity guides" context="External devsite feedback" version="t-devsite-webserver-20250211-r00-rc00.466928320959134316" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="header" class="nocontent" project-icon="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/touchicon-180-new.png" > <button> Send feedback </button> </devsite-feedback> <h1 class="devsite-page-title" tabindex="-1"> Server-side passkey authentication </h1> <devsite-feature-tooltip ack-key="AckCollectionsBookmarkTooltipDismiss" analytics-category="Site-Wide Custom Events" analytics-action-show="Callout Profile displayed" analytics-action-close="Callout Profile dismissed" analytics-label="Create Collection Callout" class="devsite-page-bookmark-tooltip nocontent" dismiss-button="true" id="devsite-collections-dropdown" dismiss-button-text="Dismiss" close-button-text="Got it"> <devsite-bookmark></devsite-bookmark> Stay organized with collections Save and categorize content based on your preferences. </devsite-feature-tooltip> <devsite-key-takeaways></devsite-key-takeaways> <div class="devsite-page-title-meta"><devsite-view-release-notes></devsite-view-release-notes></div> <devsite-toc class="devsite-nav" depth="2" devsite-toc-embedded > </devsite-toc> <div class="devsite-article-body clearfix "> <aside class="note">Note: This article is part of a series on server-side passkey implementation. Explore the other articles in this series: <a href="/identity/passkeys/developer-guides/server-introduction">Introduction to server-side passkey implementation</a> and <a href="/identity/passkeys/developer-guides/server-registration">Server-side passkey registration</a>. This article focuses on server-side functionality. To learn about the overall passkey authentication flow including client-side steps, review <a href="https://web.dev/articles/passkey-form-autofill">Sign in with a passkey</a> for the web, or <a href="https://developer.android.com/training/sign-in/passkeys#sign-in">Sign in your user with Credential Manager</a> for an Android app.</aside> <h2 id="overview" data-text="Overview" tabindex="-1">Overview</h2> Here's a high-level overview of the key steps involved in passkey authentication: <img src="https://developers.google.com/identity/passkeys/developer-guides/server-authentication/images/server-authentication.png" alt="Passkey authentication flow"> <ul> <li>Define the challenge and other options needed to authenticate with a passkey. Send them to the client, so you can pass them to your passkey authentication call (<code translate="no" dir="ltr">navigator.credentials.get</code> on the web). After the user confirms passkey authentication, the passkey authentication call is resolved and returns a credential (<code translate="no" dir="ltr">PublicKeyCredential</code>). The credential contains an authentication assertion.</li> </ul> <aside class="key-term">Key Term: The authentication assertion is a piece of data that includes the signed challenge, and other information you need as an RP to authenticate the user.</aside> <ul> <li>Verify the authentication assertion.</li> <li>If the authentication assertion is valid, authenticate the user.</li> </ul> The following sections dive into the specifics of each step. <aside class="note"> Note: While it's possible to implement server-side passkeys functionality from scratch, <a href="/identity/passkeys/developer-guides/server-introduction#server-side_libraries">we recommend that you rely on a library instead</a>. In the examples throughout this article, we'll demonstrate using a JavaScript and TypeScript FIDO server-side library called <a href="https://simplewebauthn.dev/docs/packages/server">SimpleWebAuthn</a>. While your specific server-side implementation may look slightly different depending on your chosen stack, the core concepts and key steps remain consistent. Refer to the documentation for your preferred library for detailed guidance. </aside> <h3 id="create_the_challenge" data-text="Create the challenge" tabindex="-1">Create the challenge</h3> <aside class="key-term">Key Term: The challenge is a piece of data that protects users from replay attacks. Once presented with a challenge, the passkey provider will sign it to prove that the user holds the passkey at the time of the authentication request. If an attacker intercepts an authentication request and tries to replay it to authenticate in place of the user, it will fail because the server will detect a challenge mismatch.</aside> In practice, a challenge is an array of random bytes, represented as an <a href="https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer"><code translate="no" dir="ltr">ArrayBuffer</code></a> object. <div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded><code translate="no" dir="ltr">// Example challenge, base64URL-encoded weMLPOSx1VfSnMV6uPwDKbjGdKRMaUDGxeDEUTT5VN8 </code></pre></devsite-code><aside class="special">Important: You can rely on your FIDO server-side library for challenge creation. In SimpleWebAuthn, challenge creation takes place in <code translate="no" dir="ltr">generateAuthenticationOptions</code>. See details in <a href="#create-credential-request-options">Create credential request options</a>. Out of precaution, SimpleWebAuthn uses <a href="https://github.com/MasterKale/SimpleWebAuthn/blob/3c97a9ab050c05b552de99362c0bd12749c2aae5/packages/server/src/helpers/generateChallenge.ts#L15">32-byte challenges</a> which are more secure than the <a href="https://w3c.github.io/webauthn/#sctn-cryptographic-challenges">16-bytes recommendation</a>.</aside> To ensure the challenge fulfills its purpose, you must: <ol> <li>Ensure the same challenge is never used more than once. Generate a new challenge on every sign-in attempt. Discard the challenge after every sign-in attempt, whether it succeeded or failed. Discard the challenge after a certain duration as well. Never accept the same challenge in a response more than once.</li> <li>Ensure the challenge is cryptographically secure. A challenge should be practically impossible to guess. To create a cryptographically secure challenge server-side, it's best to rely on a FIDO server-side library you trust. If you create your own challenges instead, use the built-in cryptographic functionality available in your tech stack, or look for libraries that are designed for cryptographic use cases. Examples include <a href="https://www.npmjs.com/package/@pedrouid/iso-crypto">iso-crypto</a> in Node.js, or <a href="https://docs.python.org/3/library/secrets.html">secrets</a> in Python. Per the <a href="https://w3c.github.io/webauthn/#sctn-cryptographic-challenges">specification</a>, the challenge must be at least 16 bytes long in order to be considered secure.</li> </ol> Once you've created a challenge, save it in the user's session to verify it later. <h3 id="create_credential_request_options" data-text="Create credential request options" tabindex="-1">Create credential request options</h3> Create credential request options as a <code translate="no" dir="ltr">publicKeyCredentialRequestOptions</code> object. To do so, rely on your FIDO server-side library. It will typically offer a utility function that can create these options for you. SimpleWebAuthn offers, for example, <a href="https://simplewebauthn.dev/docs/packages/server#1-generate-authentication-options"><code translate="no" dir="ltr">generateAuthenticationOptions</code></a>. <code translate="no" dir="ltr">publicKeyCredentialRequestOptions</code> should contain all the information needed for passkey authentication. Pass this information to the function in your FIDO server-side library that's responsible for creating the <code translate="no" dir="ltr">publicKeyCredentialRequestOptions</code> object. <aside class="note">Note: In this article, we focus on the fields of <code translate="no" dir="ltr">publicKeyCredentialRequestOptions</code> that require server-side work. Learn more about all the fields in <a href="https://web.dev/articles/passkey-form-autofill">Sign in with a passkey</a>.</aside> Some of <code translate="no" dir="ltr">publicKeyCredentialRequestOptions</code>' fields can be constants. Others should be dynamically defined on the server: <ul> <li><code translate="no" dir="ltr">rpId</code>: Which RP ID you expect the credential to be associated with, for example <code translate="no" dir="ltr">example.com</code>. Authentication will only succeed if the RP ID you provide here matches the RP ID associated with the credential. To populate RP ID, use the same value as the RP ID you set in <code translate="no" dir="ltr">publicKeyCredentialCreationOptions</code> during credential registration.</li> <li><code translate="no" dir="ltr">challenge</code>: A piece of data that the passkey provider will sign to prove the user holds the passkey at the time of the authentication request. Review details in <a href="#create_the_challenge">Create the challenge</a>.</li> <li><a href="https://web.dev/articles/webauthn-discoverable-credentials#allow-credentials"><code translate="no" dir="ltr">allowCredentials</code></a>: An array of acceptable credentials for this authentication. Pass an empty array to let the user select an available passkey from a list shown by the browser. Review <a href="https://web.dev/articles/passkey-form-autofill#fetch_a_challenge_from_the_rp_server">Fetch a challenge from the RP server</a> and <a href="https://web.dev/articles/webauthn-discoverable-credentials">Discoverable credentials deep dive</a> for details.</li> <li><a href="https://developer.mozilla.org/docs/Web/API/CredentialsContainer/create#userverification"><code translate="no" dir="ltr">userVerification</code></a>: Indicates whether user verification using the device screen lock is "required", "preferred" or "discouraged". Review <a href="https://web.dev/articles/passkey-form-autofill#fetch_a_challenge_from_the_rp_server">Fetch a challenge from the RP server</a>.</li> <li><code translate="no" dir="ltr">timeout</code>: How long (in milliseconds) the user can take to complete authentication. It should be reasonably generous, and shorter than the lifetime of the <code translate="no" dir="ltr">challenge</code>. The recommended default value is <a href="https://w3c.github.io/webauthn/#sctn-timeout-recommended-range">5 minutes</a>, but you can increase it — up to 10 minutes, which is still within the <a href="https://w3c.github.io/webauthn/#sctn-timeout-recommended-range">recommended range</a>. Long timeouts make sense if you expect users to use the <a href="https://developers.google.com/identity/passkeys/use-cases#sign-in-with-a-phone">hybrid workflow</a>, which typically takes a bit longer. If the operation times out, a <code translate="no" dir="ltr">NotAllowedError</code> will be thrown.</li> </ul> Once you've created <code translate="no" dir="ltr">publicKeyCredentialRequestOptions</code>, send it to the client. <figure> <img src="https://developers.google.com/identity/passkeys/developer-guides/server-authentication/images/auth-options.png" alt="publicKeyCredentialCreationOptions sent by the server" class="screenshot"> <figcaption>Options sent by the server. <code translate="no" dir="ltr">challenge</code> decoding happens client-side.</figcaption> </figure> <h3 id="example_code_create_credential_request_options" data-text="Example code: create credential request options" tabindex="-1">Example code: create credential request options</h3> We're using the <a href="#about_the_example_code">SimpleWebAuthn library</a> in our examples. Here, we hand over the creation of credential request options to its <a href="https://simplewebauthn.dev/docs/packages/server#1-generate-authentication-options"><code translate="no" dir="ltr">generateAuthenticationOptions</code></a> function. <aside class="note">Note: Operations such as <code translate="no" dir="ltr">challenge</code> creation are abstracted away, and live in SimpleWebAuthn's code. If you're curious, check SimpleWebAuthn's <a href="https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/authentication/generateAuthenticationOptions.ts">source code for <code translate="no" dir="ltr">generateAuthenticationOptions</code></a>.</aside><div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JavaScript"><code translate="no" dir="ltr">import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server'; router.post('/signinRequest', csrfCheck, async (req, res) => { // Ensure you nest calls in try/catch blocks. // If something fails, throw an error with a descriptive error message. // Return that message with an appropriate error code to the client. try { // Use the generateAuthenticationOptions function from SimpleWebAuthn const options = await generateAuthenticationOptions({ rpID: process.env.HOSTNAME, allowCredentials: [], }); // Save the challenge in the user session req.session.challenge = options.challenge; return res.json(options); } catch (e) { console.error(e); return res.status(400).json({ error: e.message }); } }); </code></pre></devsite-code> <h2 id="verify_and_sign_in_the_user" data-text="Verify and sign in the user" tabindex="-1">Verify and sign in the user</h2> When <code translate="no" dir="ltr">navigator.credentials.get</code> resolves successfully on the client, it returns a <a href="https://www.w3.org/TR/webauthn-3/#publickeycredential"><code translate="no" dir="ltr">PublicKeyCredential</code></a> object. <figure> <img src="https://developers.google.com/identity/passkeys/developer-guides/server-authentication/images/publicKeyCredential.png" alt="PublicKeyCredential object sent by the server" class="screenshot"> <figcaption><code translate="no" dir="ltr">navigator.credentials.get</code> returns a <code translate="no" dir="ltr">PublicKeyCredential</code>.</figcaption> </figure> The <code translate="no" dir="ltr">response</code> is an <a href="https://w3c.github.io/webauthn/#authenticatorassertionresponse"><code translate="no" dir="ltr">AuthenticatorAssertionResponse</code></a>. It represents the passkey provider's response to the client's instruction to create what's needed to try and authenticate with a passkey on the RP. It contains: <ul> <li><code translate="no" dir="ltr">response.authenticatorData</code>and<code translate="no" dir="ltr">response.clientDataJSON</code>, like at the <a href="/identity/passkeys/developer-guides/server-registration">passkey registration</a> step.</li> <li><code translate="no" dir="ltr">response.signature</code> which contains a signature over these values.</li> </ul> Send the <a href="https://www.w3.org/TR/webauthn-3/#iface-pkcredential"><code translate="no" dir="ltr">PublicKeyCredential</code></a> object to the server. <aside class="note">Note: The <code translate="no" dir="ltr">PublicKeyCredential</code> object includes fields that are <code translate="no" dir="ltr">ArrayBuffer</code>s, so they aren't supported by <code translate="no" dir="ltr">JSON.stringify()</code>. You must manually encode them using <code translate="no" dir="ltr">base64URL</code> before you can be send them to the server over HTTPS.</aside> On the server, do the following: <figure class="attempt-right"> <img src="https://developers.google.com/identity/passkeys/developer-guides/server-authentication/images/database-schema-passkeys.png" alt="Database schema" class="screenshot"> <figcaption>Suggested database schema. Learn more about this design in <a href="/identity/passkeys/developer-guides/server-registration">Server-side passkey registration</a>.</figcaption> </figure> <ul> <li>Gather information you'll need to verify the assertion and authenticate the user: <ul> <li>Get the expected challenge you stored in the session when you <a href="#create_credential_request_options">generated the authentication options</a>.</li> <li>Get the expected <a href="https://developer.mozilla.org/docs/Web/API/AuthenticatorResponse/clientDataJSON#origin">origin</a> and RP ID.</li> <li>Find in your database who the user is. In the case of discoverable credentials, you don't know who is the user making an authentication request. To find out, you have two options: <ul> <li>Option 1: Use the <code translate="no" dir="ltr">response.userHandle</code> in the <code translate="no" dir="ltr">PublicKeyCredential</code> object. In the Users table, look for the <code translate="no" dir="ltr">passkey_user_id</code> that matches <code translate="no" dir="ltr">userHandle</code>.</li> <li>Option 2: Use the credential <code translate="no" dir="ltr">id</code> present in the <code translate="no" dir="ltr">PublicKeyCredential</code> object. In the Public key credentials table, look for the credential <code translate="no" dir="ltr">id</code> that matches the credential <code translate="no" dir="ltr">id</code> present in the <code translate="no" dir="ltr">PublicKeyCredential</code> object. Then look for the corresponding user using the foreign key <code translate="no" dir="ltr">passkey_user_id</code> to your Users table.</li> </ul></li> <li>Find in your database the public key credential information that matches the authentication assertion you've received. To do so, in the Public key credentials table, look for the credential <code translate="no" dir="ltr">id</code> that matches the credential <code translate="no" dir="ltr">id</code>present in the <code translate="no" dir="ltr">PublicKeyCredential</code> object.</li> </ul></li> <li>Verify the authentication assertion. Hand over this verification step to your FIDO server-side library, which will typically offer a utility function for this purpose. SimpleWebAuthn offers, for example, <a href="https://simplewebauthn.dev/docs/packages/server#2-verify-authentication-response"><code translate="no" dir="ltr">verifyAuthenticationResponse</code></a>. Learn what's happening under the hood in <a href="#appendix_verification_of_the_authentication_response">Appendix: verification of the authentication response</a>.</li> <li>Delete the challenge whether verification is successful or not, to prevent replay attacks.</li> <li>Sign in the user. If the verification was successful, update session information to mark the user as signed-in. You may also want to return a <code translate="no" dir="ltr">user</code> object to the client, so the frontend can use information associated with the newly signed-in user.</li> </ul> <h3 id="example_code_verify_and_sign_in_the_user" data-text="Example code: verify and sign in the user" tabindex="-1">Example code: verify and sign in the user</h3> We're using the <a href="#about_the_example_code">SimpleWebAuthn library</a> in our examples. Here, we hand over verification of the authentication response to its <a href="https://simplewebauthn.dev/docs/packages/server#2-verify-authentication-response"><code translate="no" dir="ltr">verifyAuthenticationResponse</code></a> function. <aside class="note">Note: SimpleWebAuthn relies on the <a href="https://developer.mozilla.org/docs/Web/API/SubtleCrypto/verify">SubtleCrypto interface's <code translate="no" dir="ltr">verify()</code></a> method. SubtleCrypto is an interface of the Web Crypto API that provides low-level cryptographic functionality.</aside><div></div><devsite-code><pre class="devsite-click-to-copy" translate="no" dir="ltr" is-upgraded syntax="JavaScript"><code translate="no" dir="ltr">import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server'; import { isoBase64URL } from '@simplewebauthn/server/helpers'; router.post('/signinResponse', csrfCheck, async (req, res) => { const response = req.body; const expectedChallenge = req.session.challenge; const expectedOrigin = getOrigin(req.get('User-Agent')); const expectedRPID = process.env.HOSTNAME; // Ensure you nest verification function calls in try/catch blocks. // If something fails, throw an error with a descriptive error message. // Return that message with an appropriate error code to the client. try { // Find the credential stored to the database by the credential ID const cred = Credentials.findById(response.id); if (!cred) { throw new Error('Credential not found.'); } // Find the user - Here alternatively we could look up the user directly // in the Users table via userHandle const user = Users.findByPasskeyUserId(cred.passkey_user_id); if (!user) { throw new Error('User not found.'); } // Base64URL decode some values const authenticator = { credentialPublicKey: isoBase64URL.toBuffer(cred.publicKey), credentialID: isoBase64URL.toBuffer(cred.id), transports: cred.transports, }; // Verify the credential const { verified, authenticationInfo } = await verifyAuthenticationResponse({ response, expectedChallenge, expectedOrigin, expectedRPID, authenticator, requireUserVerification: false, }); if (!verified) { throw new Error('User verification failed.'); } // Kill the challenge for this session. delete req.session.challenge; req.session.username = user.username; req.session['signed-in'] = 'yes'; return res.json(user); } catch (e) { delete req.session.challenge; console.error(e); return res.status(400).json({ error: e.message }); } }); </code></pre></devsite-code> <h2 id="appendix_verification_of_the_authentication_response" data-text="Appendix: verification of the authentication response" tabindex="-1">Appendix: verification of the authentication response</h2> Verifying the authentication response consists of the following checks: <ul> <li>Ensure that the RP ID matches your site.</li> <li>Ensure that the request's origin matches your site's sign-in origin. For Android apps, review <a href="https://developer.android.com/training/sign-in/passkeys#verify-origin">Verify origin</a>.</li> <li>Check that the device was able to provide the challenge you gave it.</li> <li>Verify that during authentication, the user has followed the requirements you mandate as an RP. If you require user verification, ensure that the <code translate="no" dir="ltr">uv</code> (user verified) flag in <code translate="no" dir="ltr">authenticatorData</code> is <code translate="no" dir="ltr">true</code>. Check that the <code translate="no" dir="ltr">up</code> (user present) flag in <code translate="no" dir="ltr">authenticatorData</code> is <code translate="no" dir="ltr">true</code>, since user presence is <a href="https://w3c.github.io/webauthn/#sctn-op-make-cred">always required</a> for passkeys.</li> <li>Verify the signature. To verify the signature, you need: <ul> <li>The signature, which is the signed challenge: <code translate="no" dir="ltr">response.signature</code></li> <li>The public key, to verify the signature with.</li> <li>The original signed data. This is the data whose signature is to be verified.</li> <li>The cryptographic algorithm that was used to create the signature.</li> </ul></li> </ul> <aside class="note">Note: You'll often read that the passkey provider signs the <code translate="no" dir="ltr">challenge</code> to prove the user holds the passkey. This is a simplification. In reality, what the authenticator signs is a <a href="https://w3c.github.io/webauthn/#sctn-fido-u2f-sig-format-compat">concatenation</a> of <code translate="no" dir="ltr">authenticatorData</code>, and of a hash of <code translate="no" dir="ltr">clientDataJSON</code> which contains the challenge.</aside> To learn more about these steps, check SimpleWebAuthn's <a href="https://github.com/MasterKale/SimpleWebAuthn/blob/master/packages/server/src/authentication/verifyAuthenticationResponse.ts">source code for <code translate="no" dir="ltr">verifyAuthenticationResponse</code></a> or dive into the complete list of verifications in the <a href="https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion">specification</a>. </div> <devsite-recommendations display="in-page" hidden yield> </devsite-recommendations> <devsite-thumb-rating position="footer"> </devsite-thumb-rating> <devsite-feedback position="footer" project-name="Authentication" product-id="5186570" bucket="Identity guides" context="External devsite feedback" version="t-devsite-webserver-20250211-r00-rc00.466928320959134316" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="footer" class="nocontent" project-icon="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/touchicon-180-new.png" > <button> Send feedback </button> </devsite-feedback> <devsite-recommendations id="recommendations-link" yield></devsite-recommendations> <div class="devsite-floating-action-buttons"> </div> </article> <devsite-content-footer class="nocontent"> Except as otherwise noted, the content of this page is licensed under the <a href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 License</a>, and code samples are licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache 2.0 License</a>. For details, see the <a href="https://developers.google.com/site-policies">Google Developers Site Policies</a>. Java is a registered trademark of Oracle and/or its affiliates. Last updated 2024-10-31 UTC. </devsite-content-footer> <devsite-notification > </devsite-notification> <div class="devsite-content-data"> <template class="devsite-thumb-rating-feedback"> <devsite-feedback position="thumb-rating" project-name="Authentication" product-id="5186570" bucket="Identity guides" context="External devsite feedback" version="t-devsite-webserver-20250211-r00-rc00.466928320959134316" data-label="Send Feedback Button" track-type="feedback" track-name="sendFeedbackLink" track-metadata-position="thumb-rating" class="nocontent" project-icon="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/touchicon-180-new.png" > <button> Need to tell us more? </button> </devsite-feedback> </template> <template class="devsite-content-data-template"> [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-10-31 UTC."],[[["Passkeys are authenticated server-side by generating unique challenges, creating credential request options, and verifying user sign-in attempts."],["Servers use libraries like SimpleWebAuthn to generate challenges, create credential request options, and verify authentication assertions."],["The verification process ensures the request's validity and the user's identity before granting access and updating session information."],["Successful authentication using passkeys relies on matching RP IDs, origins, and verifying client data, authenticator data, and signatures."]]],[]] </template> </div> </devsite-content> </main> <devsite-footer-promos class="devsite-footer"> <nav class="devsite-footer-promos nocontent" aria-label="Promotions"> <ul class="devsite-footer-promos-list"> <li class="devsite-footer-promo"> <a href="//github.com/googlesamples/google-services" class="devsite-footer-promo-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Promo Link (index 1)" > <picture> <img class="devsite-footer-promo-icon" src="/static/site-assets/logo-github.svg" loading="lazy" alt="GitHub"> </picture> GitHub </a> <div class="devsite-footer-promo-description">Fork our samples and try them yourself</div> </li> <li class="devsite-footer-promo"> <a href="//stackoverflow.com/questions/tagged/google-signin" class="devsite-footer-promo-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Promo Link (index 2)" > <picture> <img class="devsite-footer-promo-icon" src="/static/site-assets/logo-stack-overflow.svg" loading="lazy" alt="Stack Overflow"> </picture> Stack Overflow </a> <div class="devsite-footer-promo-description">Ask a question under the google-signin tag</div> </li> <li class="devsite-footer-promo"> <a href="//googledevelopers.blogspot.com/search/label/sign-in" class="devsite-footer-promo-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Promo Link (index 3)" > <picture> <img class="devsite-footer-promo-icon" src="/static/site-assets/developers_64dp.png" loading="lazy" alt="Blog"> </picture> Blog </a> <div class="devsite-footer-promo-description">The latest news on the Google Developers blog</div> </li> <li class="devsite-footer-promo"> <a href="https://blog.chromium.org" class="devsite-footer-promo-title gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Promo Link (index 4)" > <picture> <img class="devsite-footer-promo-icon" src="https://www.gstatic.com/images/icons/material/product/2x/chrome_chromium_64dp.png" loading="lazy" alt="Chromium Blog"> </picture> Chromium Blog </a> <div class="devsite-footer-promo-description">The latest news on the Chromium blog.</div> </li> </ul> </nav> </devsite-footer-promos> <devsite-footer-linkboxes class="devsite-footer"> <nav class="devsite-footer-linkboxes nocontent" aria-label="Footer links"> <ul class="devsite-footer-linkboxes-list"> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Product Info</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="/terms" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Terms of Service </a> </li> <li class="devsite-footer-linkbox-item"> <a href="/identity/branding-guidelines" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Branding Guidelines </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Help</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="//stackoverflow.com/questions/tagged/google-signin" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Sign In With Google </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//stackoverflow.com/questions/tagged/google-identity" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Google Identity </a> </li> </ul> </li> <li class="devsite-footer-linkbox "> <h3 class="devsite-footer-linkbox-heading no-link">Developer consoles</h3> <ul class="devsite-footer-linkbox-list"> <li class="devsite-footer-linkbox-item"> <a href="//console.developers.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 1)" > Google API Console </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//console.cloud.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 2)" > Google Cloud Platform Console </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//play.google.com/apps/publish" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 3)" > Google Play Console </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//console.firebase.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 4)" > Firebase Console </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//console.actions.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 5)" > Actions on Google Console </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//cast.google.com/publish" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 6)" > Cast SDK Developer Console </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//chrome.google.com/webstore/developer/dashboard" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 7)" > Chrome Web Store Dashboard </a> </li> <li class="devsite-footer-linkbox-item"> <a href="//console.home.google.com" class="devsite-footer-linkbox-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Link (index 8)" > Google Home Developer Console </a> </li> </ul> </li> </ul> </nav> </devsite-footer-linkboxes> <devsite-footer-utility class="devsite-footer"> <div class="devsite-footer-utility nocontent"> <nav class="devsite-footer-sites" aria-label="Other Google Developers websites"> <a href="https://developers.google.com/" class="devsite-footer-sites-logo-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Google Developers Link"> <picture> <img class="devsite-footer-sites-logo" src="https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/lockup-google-for-developers.svg" loading="lazy" alt="Google Developers"> </picture> </a> <ul class="devsite-footer-sites-list"> <li class="devsite-footer-sites-item"> <a href="//developer.android.com" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Android Link" > Android </a> </li> <li class="devsite-footer-sites-item"> <a href="//developer.chrome.com/home" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Chrome Link" > Chrome </a> </li> <li class="devsite-footer-sites-item"> <a href="//firebase.google.com" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Firebase Link" > Firebase </a> </li> <li class="devsite-footer-sites-item"> <a href="//cloud.google.com" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Google Cloud Platform Link" > Google Cloud Platform </a> </li> <li class="devsite-footer-sites-item"> <a href="//ai.google.dev/" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer Google AI Link" > Google AI </a> </li> <li class="devsite-footer-sites-item"> <a href="/products" class="devsite-footer-sites-link gc-analytics-event" data-category="Site-Wide Custom Events" data-label="Footer All products Link" > All products </a> </li> </ul> </nav> <nav class="devsite-footer-utility-links" aria-label="Utility links"> <ul class="devsite-footer-utility-list"> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="/terms/site-terms" data-category="Site-Wide Custom Events" data-label="Footer Terms link" > Terms </a> </li> <li class="devsite-footer-utility-item "> <a class="devsite-footer-utility-link gc-analytics-event" href="//policies.google.com/privacy" data-category="Site-Wide Custom Events" data-label="Footer Privacy link" > Privacy </a> </li> <li class="devsite-footer-utility-item glue-cookie-notification-bar-control"> <a class="devsite-footer-utility-link gc-analytics-event" href="#" data-category="Site-Wide Custom Events" data-label="Footer Manage cookies link" aria-hidden="true" > Manage cookies </a> </li> <li class="devsite-footer-utility-item devsite-footer-utility-button"> Sign up for the Google for Developers newsletter <a class="devsite-footer-utility-link gc-analytics-event" href="/newsletter/subscribe" data-category="Site-Wide Custom Events" data-label="Footer Subscribe link" > Subscribe </a> </li> </ul> <devsite-language-selector> <ul role="presentation"> <li role="presentation"> <a role="menuitem" lang="en" >English</a> </li> <li role="presentation"> <a role="menuitem" lang="de" >Deutsch</a> </li> <li role="presentation"> <a role="menuitem" lang="es" >Español</a> </li> <li role="presentation"> <a role="menuitem" lang="es_419" >Español – América Latina</a> </li> <li role="presentation"> <a role="menuitem" lang="fr" >Français</a> </li> <li role="presentation"> <a role="menuitem" lang="id" >Indonesia</a> </li> <li role="presentation"> <a role="menuitem" lang="it" >Italiano</a> </li> <li role="presentation"> <a role="menuitem" lang="pl" >Polski</a> </li> <li role="presentation"> <a role="menuitem" lang="pt_br" >Português – Brasil</a> </li> <li role="presentation"> <a role="menuitem" lang="vi" >Tiếng Việt</a> </li> <li role="presentation"> <a role="menuitem" lang="tr" >Türkçe</a> </li> <li role="presentation"> <a role="menuitem" lang="ru" >Русский</a> </li> <li role="presentation"> <a role="menuitem" lang="he" >עברית</a> </li> <li role="presentation"> <a role="menuitem" lang="ar" >العربيّة</a> </li> <li role="presentation"> <a role="menuitem" lang="fa" >فارسی</a> </li> <li role="presentation"> <a role="menuitem" lang="hi" >हिंदी</a> </li> <li role="presentation"> <a role="menuitem" lang="bn" >বাংলা</a> </li> <li role="presentation"> <a role="menuitem" lang="th" >ภาษาไทย</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_cn" >中文 – 简体</a> </li> <li role="presentation"> <a role="menuitem" lang="zh_tw" >中文 – 繁體</a> </li> <li role="presentation"> <a role="menuitem" lang="ja" >日本語</a> </li> <li role="presentation"> <a role="menuitem" lang="ko" >한국어</a> </li> </ul> </devsite-language-selector> </nav> </div> </devsite-footer-utility> <devsite-panel></devsite-panel> <devsite-concierge data-info-panel data-ai-panel data-api-explorer-panel > </devsite-concierge> </section></section> <devsite-sitemask></devsite-sitemask> <devsite-snackbar></devsite-snackbar> <devsite-tooltip ></devsite-tooltip> <devsite-heading-link></devsite-heading-link> <devsite-analytics> <script type="application/json" analytics>[{"dimensions": {"dimension6": "en", "dimension5": "en", "dimension1": "Signed out", "dimension11": false, "dimension3": false, "dimension4": "Authentication"}, "gaid": "UA-24532603-1", "metrics": {"ratings_value": "metric1", "ratings_count": "metric2"}, "purpose": 1}]</script> <script type="application/json" tag-management>{"at": "True", "ga4": [{"id": "G-272J68FCRF", "purpose": 1}], "ga4p": [{"id": "G-272J68FCRF", "purpose": 1}], "gtm": [], "parameters": {"internalUser": "False", "language": {"machineTranslated": "False", "requested": "en", "served": "en"}, "pageType": "article", "projectName": "Authentication", "signedIn": "False", "tenant": "developers", "recommendations": {"sourcePage": "", "sourceType": 0, "sourceRank": 0, "sourceIdenticalDescriptions": 0, "sourceTitleWords": 0, "sourceDescriptionWords": 0, "experiment": ""}, "experiment": {"ids": ""}}}</script> </devsite-analytics> <devsite-badger></devsite-badger> <script nonce="rsNp672smXZL4ypzul1jx7cmQFZiJA"> (function(d,e,v,s,i,t,E){d['GoogleDevelopersObject']=i; t=e.createElement(v);t.async=1;t.src=s;E=e.getElementsByTagName(v)[0]; E.parentNode.insertBefore(t,E);})(window, document, 'script', 'https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/js/app_loader.js', '[1,"en",null,"/js/devsite_app_module.js","https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f","https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers","https://developers-dot-devsite-v2-prod.appspot.com",1,null,["/_pwa/developers/manifest.json","https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/images/video-placeholder.svg","https://www.gstatic.com/devrel-devsite/prod/v38a693baeb774512feb42f10aac8f755d8791ed41119b5be7a531f8e16f8279f/developers/images/favicon-new.png","https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:400,400italic,500,500italic,700,700italic|Roboto+Mono:400,500,700&display=swap"],1,null,[1,6,8,12,14,17,21,25,50,52,63,70,75,76,80,87,91,92,93,97,98,100,101,102,103,104,105,107,108,109,110,112,113,116,117,118,120,122,124,125,126,127,129,130,131,132,133,134,135,136,138,140,141,147,148,149,151,152,156,157,158,159,161,163,164,168,169,170,179,180,182,183,186,191,193,196],"AIzaSyAP-jjEJBzmIyKR4F-3XITp8yM9T1gEEI8","AIzaSyB6xiKGDR5O3Ak2okS4rLkauxGUG7XP0hg","developers.google.com","AIzaSyAQk0fBONSGUqCNznf6Krs82Ap1-NV6J4o","AIzaSyCCxcqdrZ_7QMeLCRY20bh_SXdAYqy70KY",null,null,null,["MiscFeatureFlags__enable_variable_operator","EngEduTelemetry__enable_engedu_telemetry","MiscFeatureFlags__enable_explain_this_code","Experiments__reqs_query_experiments","Profiles__enable_developer_profiles_callout","Search__enable_ai_search_summaries","Profiles__enable_profile_collections","Cloud__enable_cloudx_experiment_ids","Analytics__enable_clearcut_logging","Profiles__enable_join_program_group_endpoint","Search__enable_page_map","Profiles__enable_page_saving","MiscFeatureFlags__developers_footer_image","Cloud__enable_cloud_dlp_service","Profiles__enable_awarding_url","Concierge__enable_concierge_restricted","MiscFeatureFlags__enable_firebase_utm","Cloud__enable_llm_concierge_chat","MiscFeatureFlags__emergency_css","Cloud__enable_legacy_calculator_redirect","Cloud__enable_cloud_shell_fte_user_flow","Profiles__require_profile_eligibility_for_signin","Profiles__enable_stripe_subscription_management","Profiles__enable_dashboard_curated_recommendations","Profiles__enable_recognition_badges","Concierge__enable_concierge","Search__enable_suggestions_from_borg","Significatio__enable_by_tenant","TpcFeatures__enable_unmirrored_page_left_nav","Search__enable_ai_eligibility_checks","DevPro__enable_developer_subscriptions","Cloud__enable_cloud_facet_chat","Profiles__enable_release_notes_notifications","CloudShell__cloud_code_overflow_menu","Profiles__enable_public_developer_profiles","Profiles__enable_completecodelab_endpoint","Concierge__enable_key_takeaways","BookNav__enable_tenant_cache_key","Search__enable_dynamic_content_confidential_banner","Concierge__enable_pushui","TpcFeatures__enable_mirror_tenant_redirects","Cloud__enable_cloudx_ping","MiscFeatureFlags__developers_footer_dark_image","MiscFeatureFlags__enable_view_transitions","Cloud__enable_free_trial_server_call","Profiles__enable_complete_playlist_endpoint","CloudShell__cloud_shell_button","Cloud__enable_cloud_shell","Search__enable_ai_search_summaries_restricted","DevPro__enable_cloud_innovators_plus","Profiles__enable_completequiz_endpoint","MiscFeatureFlags__enable_project_variables"],null,null,"AIzaSyBLEMok-5suZ67qRPzx0qUtbnLmyT_kCVE","https://developerscontentserving-pa.clients6.google.com","AIzaSyCM4QpTRSqP5qI4Dvjt4OAScIN8sOUlO-k","https://developerscontentsearch-pa.clients6.google.com",1,4,null,"https://developerprofiles-pa.clients6.google.com",[1,"developers","Google for Developers","developers.google.com",null,"developers-dot-devsite-v2-prod.appspot.com",null,null,[1,1,[1],null,null,null,null,null,null,null,null,[1],null,null,null,null,null,null,[1],[1,null,null,[1,20],"/recommendations/information"],null,null,null,[1,1,1],[1,1,null,1,1]],null,[null,null,null,null,null,null,"/images/lockup-new.svg","/images/touchicon-180-new.png",null,null,null,null,1,null,null,null,null,null,null,null,null,1,null,null,null,"/images/lockup-dark-theme-new.svg",[]],[],null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,[6,1,14,15,20,22,23,29,32,36],null,[[null,null,null,[3,7,10,2,39,17,4,32,24,11,12,13,34,15,25],null,null,[1,[["docType","Choose a content type",[["Tutorial",null,null,null,null,null,null,null,null,"Tutorial"],["Guide",null,null,null,null,null,null,null,null,"Guide"],["Sample",null,null,null,null,null,null,null,null,"Sample"]]],["product","Choose a product",[["Android",null,null,null,null,null,null,null,null,"Android"],["ARCore",null,null,null,null,null,null,null,null,"ARCore"],["ChromeOS",null,null,null,null,null,null,null,null,"ChromeOS"],["Firebase",null,null,null,null,null,null,null,null,"Firebase"],["Flutter",null,null,null,null,null,null,null,null,"Flutter"],["Assistant",null,null,null,null,null,null,null,null,"Google Assistant"],["GoogleCloud",null,null,null,null,null,null,null,null,"Google Cloud"],["GoogleMapsPlatform",null,null,null,null,null,null,null,null,"Google Maps Platform"],["GooglePay",null,null,null,null,null,null,null,null,"Google Pay & Google Wallet"],["GooglePlay",null,null,null,null,null,null,null,null,"Google Play"],["Tensorflow",null,null,null,null,null,null,null,null,"TensorFlow"]]],["category","Choose a topic",[["AiAndMachineLearning",null,null,null,null,null,null,null,null,"AI and Machine Learning"],["Data",null,null,null,null,null,null,null,null,"Data"],["Enterprise",null,null,null,null,null,null,null,null,"Enterprise"],["Gaming",null,null,null,null,null,null,null,null,"Gaming"],["Mobile",null,null,null,null,null,null,null,null,"Mobile"],["Web",null,null,null,null,null,null,null,null,"Web"]]]]]],[1,1],null,1],[[["UA-24532603-1"],["UA-22084204-5"],null,null,["UA-24532603-5"],null,null,[["G-272J68FCRF"],null,null,[["G-272J68FCRF",2]]],[["UA-24532603-1",2]],null,[["UA-24532603-5",2]],null,1],[[14,11],[5,4],[16,13],[1,1],[15,12],[11,8],[4,3],[12,9],[6,5],[13,10],[3,2]],[[2,2],[1,1]]],null,4,null,null,null,null,null,null,null,null,null,null,null,null,null,"developers.devsite.google"],null,"pk_live_5170syrHvgGVmSx9sBrnWtA5luvk9BwnVcvIi7HizpwauFG96WedXsuXh790rtij9AmGllqPtMLfhe2RSwD6Pn38V00uBCydV4m",1]') </script> <devsite-a11y-announce></devsite-a11y-announce> </body> </html>

CINXE.COM

Server-side passkey authentication | Authentication | Google for Developers