PasskeyAuthenticator

Verifies a passkey login and returns the user it belongs to.

class PasskeyAuthenticator

Like Hazaar\Auth\Authenticator\PasswordAuthenticator, it only verifies and never starts a session: pass the returned Hazaar\Auth\Identity to Hazaar\Auth\Adapter::login or Hazaar\Auth\SessionManager::login.

$identity = $passkeys->verify($request->getJSONBody(true));   // throws AuthenticationFailed
$result   = $auth->login($identity);

Properties

relyingParty

private RelyingParty $relyingParty

Type: Hazaar\Auth\WebAuthn\RelyingParty

users

private UserProvider $users

Type: Hazaar\Auth\Interface\UserProvider

Methods

__construct

public __construct(RelyingParty $relyingParty, UserProvider $users): void

Parameters

Parameter	Type	Description
$relyingParty	Hazaar\Auth\WebAuthn\RelyingParty
$users	Hazaar\Auth\Interface\UserProvider

verify

Verifies the browser's answer to Hazaar\Auth\WebAuthn\RelyingParty::startAuthentication.

public verify(array $response): Identity

Returns: Hazaar\Auth\Identity

The user must still exist in the provider, so a deleted or disabled user can't log in with an old passkey.

Parameters

Parameter	Type	Description
$response	array	the AuthenticationResponseJSON from credential.toJSON()

---

Generated by Hazaar API Doc Generator on Wed, 28 Oct 2026 08:43:30 +0000