v0.4.0 - PRF evalByCredential & credProps Extension Support

react-native-passkeys v0.4.0 🎉

A significant release adding advanced WebAuthn extensions support and improving cross-platform consistency.

🚀 New Features

PRF Extension - Complete Support

The PRF (Pseudo-Random Function) extension is now fully supported, allowing you to derive cryptographic keys from credentials. This release adds evalByCredential support on top of the existing eval functionality.

Using eval for single PRF input:

// Derive a key using a single salt input
await passkey.get({
  rpId: "example.com",
  challenge: "...",
  extensions: {
    prf: {
      eval: {
        first: "base64url-encoded-salt",
        // optional second salt
        second: "base64url-encoded-salt-2",
      },
    },
  },
});

Using evalByCredential for per-credential inputs:

// Derive different keys for different credentials
await passkey.get({
  rpId: "example.com",
  challenge: "...",
  extensions: {
    prf: {
      evalByCredential: {
        [credentialId]: {
          first: "base64url-encoded-salt",
          // optional second salt
        },
      },
    },
  },
  allowCredentials: [{ id: credentialId, type: "public-key" }],
});

Platform Support:

• ✅ iOS 18+
• ✅ Android API 34+
• ✅ Web (all modern browsers with WebAuthn Level 3)

Spec Compliance:

• Validates that allowCredentials is specified when using evalByCredential per WebAuthn Level 3 spec

credProps Extension Support

The credential properties extension (credProps) is now supported, allowing you to determine whether a credential is a client-side discoverable credential (passkey).

const result = await passkey.create({
  // ... other options
  extensions: {
    credProps: true,
  },
});

// Check if the credential is discoverable
const isDiscoverable = result?.clientExtensionResults?.credProps?.rk;

Platform Support:

• ✅ Android API 34+
• ✅ Web
• 🚧 iOS (types included, implementation pending)

✨ Improvements

Cross-Platform Consistency

• getPublicKey() Normalization: Now returns Base64URLString on all platforms instead of ArrayBuffer on web. This provides a consistent API across iOS, Android, and Web.

Enhanced Type Safety

• Improved TypeScript types for credential responses
• Better type inference for extension outputs
• More precise types for PRF inputs and outputs

Better Error Handling

• Enhanced input validation on iOS
• Better error messages for invalid PRF inputs
• Improved exception handling across all platforms

Documentation

• Comprehensive JSDoc comments across Android and iOS implementations
• Updated example app demonstrating new features
• Improved inline documentation for extension types

📱 Example App Updates

• Add demonstration of evalByCredential usage
• Upgrade to Expo SDK 54
• Upgrade Android compile SDK to 36
• Improve type safety and UI handling
• Add type definitions for @hexagon/base64

⚠️ Breaking Changes

getPublicKey() Return Type (Web only)

Previously on web, getPublicKey() returned ArrayBuffer | null. It now returns Base64URLString | null for consistency with iOS and Android implementations.

Migration:

// Before (web only)
const publicKeyBuffer = response.getPublicKey();
// convert to base64url manually

// After (all platforms)
const publicKeyBase64 = response.getPublicKey();
// Already in base64url format, ready to send to server

📚 Related Issues & PRs

• Closes #31 - Apple and iOS WebAuthn PRF support
• Builds on #51 - feat: add support for PRF (eval) by @sparten11740
• Part of ongoing WebAuthn Level 3 compliance work

🙏 Acknowledgments

Thanks to @sparten11740 (Jan W) for the initial PRF implementation that this release builds upon.

---

Full Changelog: v0.3.3...v0.4.0