feat(auth): add passkey support with WebAuthn registration, authentication, and management

[fadymak]

Adds client-side passkey API with full WebAuthn ceremony handling, a lower-level two-step API via auth.passkey namespace, passkey management, and admin endpoints for server-side passkey operations.

The new API:

// High-level (full WebAuthn ceremony)
auth.signInWithPasskey()
auth.registerPasskey()

// Lower-level two-step API (for native flows or complete control over the ceremony)
auth.passkey.startRegistration()
auth.passkey.verifyRegistration()
auth.passkey.startAuthentication()
auth.passkey.verifyAuthentication()

// Management
auth.passkey.list()
auth.passkey.update()
auth.passkey.delete()

// Admin
auth.admin.passkey.listPasskeys()
auth.admin.passkey.deletePasskey()

Introduces concept of experimental feature flags to require callers to explicitly opt in explicitly:

Enable it when creating the client:

const supabase = createClient(supabaseUrl, supabaseKey, {
  auth: {
    experimental: { passkey: true },
  },
})

Without the flag, every passkey method throws a descriptive Error pointing to the opt-in key.

[pkg-pr-new]

Open in StackBlitz

@supabase/auth-js

npm i https://pkg.pr.new/@supabase/auth-js@2263

@supabase/functions-js

npm i https://pkg.pr.new/@supabase/functions-js@2263

@supabase/postgrest-js

npm i https://pkg.pr.new/@supabase/postgrest-js@2263

@supabase/realtime-js

npm i https://pkg.pr.new/@supabase/realtime-js@2263

@supabase/storage-js

npm i https://pkg.pr.new/@supabase/storage-js@2263

@supabase/supabase-js

npm i https://pkg.pr.new/@supabase/supabase-js@2263

commit: a464075

[flobo79]

🔥🔥🔥🔥- realisitically, is this going to happen and how far away? Is it worth waiting with my own implementation?

[mandarini]

Great PR @fadymak ! :D I assume the server changes are already in place?