Context
WhatsApp has been rolling out mandatory passkey/WebAuthn for account security (announced Aug 25, 2026 — WhatsApp Blog, Android Developers Blog), and it now appears to extend into the device-linking (QR pairing) flow itself, not just 2FA. This has already broken projects that reimplement the WhatsApp protocol (Baileys-based tools), since they can't produce a real WebAuthn assertion:
Some third-party BSP/API providers are also warning customers about this in advance (e.g. a webinar from GREEN-API flagging "connecting to the API without a PassKey will become impossible").
Question
wa-js is architecturally different from Baileys — it injects into the real WhatsApp Web page running in a browser (via Puppeteer/WPPConnect), rather than reimplementing the Signal protocol from scratch. So it seems plausible wa-js is much less exposed to this than Baileys-style libraries, but I'd like to confirm:
- Does the new WebAuthn requirement surface inside the actual WhatsApp Web page during QR device-linking, and if so, does headless Chromium (no platform authenticator) block that step for WPPConnect/wa-js sessions?
- Is there any known impact yet on wa-js users trying to pair a new session, or on existing sessions when the account owner has a passkey enabled?
- Is this being tracked by the maintainers, or is there a recommended path/workaround for accounts that require a passkey?
Couldn't find an existing issue or discussion here covering WebAuthn/passkey/428, so opening this to get it on the radar and see if anyone has already run into it.
Context
WhatsApp has been rolling out mandatory passkey/WebAuthn for account security (announced Aug 25, 2026 — WhatsApp Blog, Android Developers Blog), and it now appears to extend into the device-linking (QR pairing) flow itself, not just 2FA. This has already broken projects that reimplement the WhatsApp protocol (Baileys-based tools), since they can't produce a real WebAuthn assertion:
Some third-party BSP/API providers are also warning customers about this in advance (e.g. a webinar from GREEN-API flagging "connecting to the API without a PassKey will become impossible").
Question
wa-js is architecturally different from Baileys — it injects into the real WhatsApp Web page running in a browser (via Puppeteer/WPPConnect), rather than reimplementing the Signal protocol from scratch. So it seems plausible wa-js is much less exposed to this than Baileys-style libraries, but I'd like to confirm:
Couldn't find an existing issue or discussion here covering WebAuthn/passkey/428, so opening this to get it on the radar and see if anyone has already run into it.