Practical Takeaways
- Start with the mental model: registration creates a credential, authentication proves possession.
- Treat RP ID as site identity: domain only, shared across ports, scoped across subdomains.
- Verify on the server: challenge, origin, RP ID, signature, and counter behavior.
- Use a mature library and spend your time on UX, recovery, and rollout.
- For JavaScript teams, passkeys are mostly an integration problem, not a cryptography project.