Test web authentication (WebAuthn) API flows on your password-less websites

Learn how to test WebAuthn API flows on Live.

Some websites support password-less authentication using the Web Authentication (WebAuthn) APIs. WebAuthn is a specification written by the W3C and FIDO that allows websites to register and authenticate users using passkeys (public key cryptography) instead of a password.

You can test websites that implement WebAuthn APIs to support password-less authentication on Live. To test such websites, you need to complete the following steps:

1. Set up a Google account on the device
2. Set up device passcode
3. Set Google account to use passkeys
4. Test WebAuthn API flow

Supported OS and browsers

• Devices running Android version 11 and higher
• All browsers on Android

Set up a Google account on the device

To set up a Google account on the device:

1. Log in to the Live dashboard.
2. Select a device-browser combination to launch a test session.
3. On the vertical toolbar, click Show Home Screen.
4. Open the Settings app.
5. Click the Google option to set up a Google account on the device.
6. Click Sign in to your Google account.
7. Follow the steps for Google account sign-in.

Your Google account is now set up on the device.

Set up device passcode

To set up the device passcode, follow these steps in the Live session:

1. On the Live vertical toolbar, click Settings.
2. In the Android Settings section, switch the Device Passcode toggle to on.
   The device passcode is set to 1234. When prompted, enter the passcode using your local system keyboard and press Enter.
   

Set up a Google account to use passkeys

To set your Google account to use passkeys for signing in, follow these steps in the Live session:

1. On the vertical toolbar, click Show Home Screen.
2. Open the Settings app.
3. Click Google and then click Manage your Google account.
4. Go to the Security tab. Scroll down and click Passkeys and security keys.
5. Click Continue and enter the device passcode.
   The screen might blackout. Enter the 1234 device passcode using your local system keyboard and press Enter.
6. Click Use passkeys.
   Your Google account is now set up to use passkeys for sign-in. Click Done.

Test WebAuthn API flow

To demonstrate how to test WebAuthn API flows, we have used the WebAuthn demo website. The registration and authentication steps might differ depending on your website implementation.

To test WebAuthn API flow, follow these steps in the Live session:

1. Open your website on the device.
2. Start the sign-in workflow.
3. Enter the username and click Register to register the user.
   The passkeys are saved in your Google account. Click Continue.
4. You are asked to use the screen lock. Click Use screen lock.
   
5. You are prompted to enter the device passcode.
   The screen might blackout. Enter the 1234 device passcode using your local system keyboard and press Enter. You are now successfully registered.
6. The username is prefilled. Click Authenticate to authenticate the user.

You have now successfully tested WebAuthn API flows on your password-less website!