Web Authentication (WebAuthn)
Passkeys are the modern replacement for passwords. WebAuthn is the browser API. Every new auth system should evaluate it for primary or MFA flow.
What It Defines
W3C/FIDO spec for phishing-resistant authentication using public key cryptography. Powers passkeys, hardware security keys (YubiKey), and platform biometric authenticators (Touch ID, Face ID).
Canonical (Normative)
Convenient (Practical)
Publishes web platform specs including CSS, accessibility, security policies, Service Workers, Web App Manifest, and many browser APIs. Also maintains some versioned HTML/DOM specs.
Related Specs
Sign-in with Google/Apple/GitHub all use OIDC. If your app authenticates users via a third party, you're using OIDC whether you know it or not.
The foundation of modern app auth: third-party login, API authorization, SSO, and machine-to-machine access all use OAuth 2.0.