WebAuthn Options Explainer

When calling navigator.credentials.create, three fields define login behaviour, and the combination between them is what separates a real passkey from an ordinary second factor. Getting this wrong produces a system that appears to work but does not do what you pictured — usually still demanding a password forever, when the point was to remove it.

authenticatorAttachment picks the kind of authenticator: platform accepts only what is built into the device, such as Touch ID and Windows Hello; cross-platform accepts only external keys such as a YubiKey; omitting it accepts both. userVerification decides whether the authenticator must confirm who is present, via biometrics or a PIN, or whether detecting presence is enough. residentKey decides whether the credential is stored on the authenticator with its own identifier — which is what allows signing in without typing a username.

Pick the three options and the page explains each choice and delivers the verdict: with userVerification required and residentKey required, you have a passwordless setup; in any other combination it is classic 2FA and the password is still needed. Worth noting that a required residentKey consumes storage on the authenticator — older security keys hold only a few dozen credentials.