Registration

const credential = await navigator.credentials.create({
  publicKey: {
    challenge,
    rp: { id: 'example.com', name: 'Example App' },
    user,
    pubKeyCredParams: [{ alg: -7, type: 'public-key' }],
  },
});

• challenge comes from your server.
• rp.id must match your site identity rules.
• The browser talks to the authenticator for you.

Authentication

const assertion = await navigator.credentials.get({
  publicKey: {
    challenge,
    rpId: 'example.com',
    userVerification: 'preferred',
  },
});

• Your server sends a fresh challenge again.
• The browser finds a matching credential.
• The authenticator signs the challenge response.