RelyingParty

Runs WebAuthn (passkey) ceremonies for a relying party: registering passkeys and checking logins with them.

class RelyingParty

It only verifies. It never starts a session; see Hazaar\Auth\Authenticator\PasskeyAuthenticator.

Each ceremony has two steps. The start method returns options to send to the browser as JSON, which passes them to PublicKeyCredential.parseCreationOptionsFromJSON() / parseRequestOptionsFromJSON(). The browser's answer, credential.toJSON(), goes to the matching finish method. Every check in WebAuthn Level 3 sections 7.1 and 7.2 is made, except attestation: none is requested and any attestation statement is ignored.

Constants

array

private const array = null

array

private const array = null

array

private const array = null

Properties

options

private Options $options

Type: Hazaar\Auth\WebAuthn\Options

store

private PasskeyCredentialStore $store

Type: Hazaar\Auth\Interface\PasskeyCredentialStore

challenges

private ChallengeStore $challenges

Type: Hazaar\Auth\WebAuthn\ChallengeStore

Methods

__construct

public __construct(array|Options $options, ?PasskeyCredentialStore $store, ?ChallengeStore $challenges): void

Parameters

Parameter	Type	Description
$options	array	Hazaar\Auth\WebAuthn\Options
$store	Hazaar\Auth\Interface\PasskeyCredentialStore	overrides the store option
$challenges	Hazaar\Auth\WebAuthn\ChallengeStore	overrides the challengeCache option

fromConfig

Builds a relying party from the application's auth.webauthn config.

public fromConfig(): self

Returns: self

getStore

public getStore(): PasskeyCredentialStore

Returns: Hazaar\Auth\Interface\PasskeyCredentialStore

startRegistration

Starts registering a passkey for a user, who should already be signed in (ideally recently).

public startRegistration(string $identity, ?string $displayName): array

Returns: array

Parameters

Parameter	Type	Description
$identity	string	the user's identity
$displayName	string	the name the browser shows for the account (defaults to the identity)

finishRegistration

Verifies the browser's answer to Hazaar\Auth\WebAuthn\RelyingParty::startRegistration and stores the new passkey.

public finishRegistration(array $response, string $identity, ?string $name): PasskeyCredential

Returns: Hazaar\Auth\WebAuthn\PasskeyCredential

Parameters

Parameter	Type	Description
$response	array	the RegistrationResponseJSON from credential.toJSON()
$identity	string	the signed-in user; must be the one registration was started for
$name	string	a label for the passkey

startAuthentication

Starts a login with a passkey.

public startAuthentication(?string $identity): array

Returns: array

Parameters

Parameter	Type	Description
$identity	string	the user, if they typed their username first; omit it to let the browser offer any of the site's passkeys (username-less and autofill sign-in)

finishAuthentication

Verifies the browser's answer to Hazaar\Auth\WebAuthn\RelyingParty::startAuthentication.

public finishAuthentication(array $response): VerifiedAssertion

Returns: Hazaar\Auth\WebAuthn\VerifiedAssertion

Parameters

Parameter	Type	Description
$response	array	the AuthenticationResponseJSON from credential.toJSON()

listCredentials

public listCredentials(string $identity): array

Returns: array

Parameters

Parameter	Type	Description
$identity	string

renameCredential

public renameCredential(string $identity, string $credentialId, string $name): bool

Returns: bool

Parameters

Parameter	Type	Description
$identity	string
$credentialId	string
$name	string

deleteCredential

public deleteCredential(string $identity, string $credentialId): bool

Returns: bool

Parameters

Parameter	Type	Description
$identity	string
$credentialId	string

requiresUserVerification

private requiresUserVerification(): bool

Returns: bool

verifyClientData

private verifyClientData(ClientData $clientData, string $type, string $challenge): void

Returns: void

Parameters

Parameter	Type	Description
$clientData	Hazaar\Auth\WebAuthn\ClientData
$type	string
$challenge	string

verifyAuthenticatorData

private verifyAuthenticatorData(AuthenticatorData $authData, bool $userVerification): void

Returns: void

Parameters

Parameter	Type	Description
$authData	Hazaar\Auth\WebAuthn\AuthenticatorData
$userVerification	bool

credentialResponse

Checks the common shape of a credential response and decodes its base64url fields.

private credentialResponse(array $response, array $required): array

Returns: array

Parameters

Parameter	Type	Description
$response	array
$required	array	the response members that must be present

descriptor

private descriptor(PasskeyCredential $credential): array

Returns: array

Parameters

Parameter	Type	Description
$credential	Hazaar\Auth\WebAuthn\PasskeyCredential

transports

private transports(mixed $transports): array

Returns: array

Parameters

Parameter	Type	Description
$transports	mixed

createStore

private createStore(): PasskeyCredentialStore

Returns: Hazaar\Auth\Interface\PasskeyCredentialStore

validate

private validate(): void

Returns: void

---

Generated by Hazaar API Doc Generator on Wed, 28 Oct 2026 08:43:30 +0000