Native passkey experience on Apple platforms

[groue]

Hello,

Apple platforms offer support for passkeys in browsers, but also in native applications. This question is about Ory Kratos and native macOS/iOS apps.

I can read in Ory documentation:

WebAuthn is a browser-only standard. It doesn't work with native mobile apps.

Is this limitation still accurate?

If so, is there any plan to lift it?

Any advice from other experienced user?

Thank you very much in advance!

A short description of the mismatch between Kratos apis and Apple SDK

The native Apple SDK supports various scenarios involving passkeys: registration, authentication, etc.

There is a sample application, as well as a Supporting passkeys guide.

Most native apis require a server challenge. And I don't find in the Ory Identities API any endpoint that provides such a challenge:

• /.well-known/ory/webauthn.js is for Javascript applications.
• /self-service/login/api does not return any WebAuthn challenge.

So it indeed looks like it is impossible to leverage the Ory Kratos support for passkeys from a native iOS or macOS application.

I wish I'm wrong and I was just unable to navigate the documentation correctly!

[thomastthai]

I was looking for similar answers and implementations in a previous discussion. So far, nothing concrete yet.

[kmherrmann]

Thanks for the question. Yes, the limitation is still current, and yes, we have plans to lift it and will ship improvements to our API-based flows in the coming months - including full Webauthn support.

[groue]

Thank you very much @kmherrmann for lifting the doubt 👍

[kmherrmann]

This is now in development and should become generally available in the next few weeks.

[vinckr]

It is released now @groue !
https://changelog.ory.sh/announcements/native-social-sign-in-with-apple

[groue]

Thank you, and congratulations 🎉🙂

[ajcampbell]

Thank you very much. Sent from my iPhoneOn 29 Sep 2023, at 08:49, Vincent ***@***.***> wrote: It is released now @groue ! https://changelog.ory.sh/announcements/native-social-sign-in-with-apple —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you commented.Message ID: ***@***.***>

[slashmo]

Hey @vinckr, thanks for working on better native integrations 👋
I'm a bit confused about the status of native passkey support. As far as I understand the comment above (#3038 (comment)) and the original question it should be available now. The linked changelog entry is about Sign in with Apple though, not passkeys. For native passkeys we'll still need the challenge parameter on iOS to pass to Apple's SDK: https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys
Is this available in Ory Cloud already, still a work in progress, or not yet started?