ez-php / webauthn

2.5.6 2026-09-30 18:37 UTC

Requires

• php: ^8.5
• ext-openssl: *
• ext-sodium: *

Requires (Dev)

• ez-php/contracts: ^2.0
• ez-php/docker: ^2.0
• friendsofphp/php-cs-fixer: ^3.94
• phpstan/phpstan: ^2.1
• phpstan/phpstan-deprecation-rules: ^2.0
• phpstan/phpstan-strict-rules: ^2.0
• phpunit/phpunit: ^13.0

Suggests

• ez-php/contracts: Needed for SecondFactorAssertionVerifier (EzPhp\Contracts\SecondFactorResult)

MIT

• Andreas Uretschnig

• php
• security
• Authentication
• FIDO2
• webauthn
• passkey
• ez-php

Published on Packagist.org on 2026-09-30 18:44 UTC

README

WebAuthn / FIDO2 passkey authentication: registration and assertion ceremonies, attestation verification, challenge handling.

Installation

composer require ez-php/webauthn

Usage

See docs/superpowers/specs/2026-09-14-webauthn-module-design.md for the full design. Quick start:

$relyingParty = new RelyingParty(id: 'example.com', name: 'Example', allowedOrigins: ['https://example.com']);
$ceremony = new RegistrationCeremony($relyingParty);
$credentialSource = $ceremony->verify($challenge, $clientResponse);
$credentialRepository->save($credentialSource);

Second-factor login flows

If your application also uses ez-php/two-factor and wants one result type for either mechanism, wrap assertion verification with SecondFactorAssertionVerifier — it reports the same EzPhp\Contracts\SecondFactorResult enum TwoFactorManager::verifyForUser() returns. This requires adding ez-php/contracts yourself (it's a require-dev-only dependency of this package, not a runtime one):

use EzPhp\WebAuthn\SecondFactorAssertionVerifier;

$verifier = new SecondFactorAssertionVerifier($ceremony);
$result = $verifier->verify($challenge, $clientDataJson, $authenticatorData, $signature, $credentialId, $credentialRepository);

if ($result === \EzPhp\Contracts\SecondFactorResult::Satisfied) {
    $credentialRepository->save($verifier->getVerifiedCredential()); // persist the updated sign count
}

This does not merge ez-php/webauthn with ez-php/two-factor — both modules remain independent and mutually exclusive; only the outcome type is shared.

License

MIT