Options

The auth.webauthn options for Hazaar\Auth\WebAuthn\RelyingParty.

class Options extends \Hazaar\Model\Struct

Extends: Hazaar\Model\Struct

rpId and origins have no defaults and must be set: they are never worked out from the request, whose Host header the client controls.

Properties

rpId

The relying party ID: the domain passkeys are bound to, such as example.com. Every origin must be this

public string $rpId

Type: string

domain or a subdomain of it.

rpName

The name the browser shows the user, such as the site or company name.

public string $rpName

Type: string

origins

The exact origins ceremonies may come from, such as https://example.com (scheme, host and any port).

public array $origins

Type: array

allowCrossOrigin

Whether to accept ceremonies run inside a cross-origin iframe. Off by default.

public bool $allowCrossOrigin

Type: bool

topOrigins

The top-level origins a cross-origin iframe may be embedded in. Only used with allowCrossOrigin.

public array $topOrigins

Type: array

userVerification

required (the default), preferred or discouraged. With required, every ceremony must verify the user

public string $userVerification = 'required'

Type: string

(PIN, biometrics), not just their presence.

residentKey

required (the default), preferred or discouraged: whether passkeys must be discoverable, which is what

public string $residentKey = 'required'

Type: string

allows signing in without typing a username.

algorithms

The COSE algorithms offered, in order of preference.

public array $algorithms = array (
  0 => 'COSEKey',
  1 => NULL,
  2 => 'EDDSA',
  3 => 'COSEKey',
  4 => NULL,
  5 => 'ES256',
  6 => 'COSEKey',
  7 => NULL,
  8 => 'RS256',
)

Type: array

timeout

How long a ceremony may take, in seconds.

public int $timeout = 300

Type: int

signCountPolicy

What to do when an authenticator's signature counter goes backwards, which can mean a cloned authenticator:

public string $signCountPolicy = 'reject'

Type: string

reject (the default) or warn (log and allow).

hints

Hints for the browser's UI: security-key, client-device and/or hybrid.

public array $hints

Type: array

store

Where passkeys are stored: a Hazaar\Auth\Interface\PasskeyCredentialStore class-string (constructed with storeOptions) or

public PasskeyCredentialStore|string $store = 'FileStore'

Type: Hazaar\Auth\Interface\PasskeyCredentialStore|string

instance.

storeOptions

Options for the store, when store is a class-string.

public array $storeOptions

Type: array

challengeCache

The cache challenges are kept in: backend and options, as for Hazaar\Cache\Adapter. Defaults to

public array $challengeCache

Type: array

the application's default cache.

---

Generated by Hazaar API Doc Generator on Wed, 28 Oct 2026 08:43:30 +0000