Unable to register or use passkeys via Safari Web Extension

Question

Created Feb ’25

Replies 2

Boosts 1

Participants 2

There does not appear to be any way to use or create iCloud passkeys with a Safari Web Extension, either using the navigator.credentials API in an extension origin webpage such as the popover, or using the AuthenticationServices framework in the SafariWebExtensionHandler.

I've setup an associated domain for my plugin, and I know it works for the host application. But I get errors trying to do so in the web extension target.

createCredentialRegistrationRequests results in the following error:

Domain=com.apple.AuthenticationServices.AuthorizationError Code=1004 "Application with identifier <ID> is not associated with domain <RPID>

The other problem, assuming the entitlement works correctly for the web extension, is that there is no NSWindow to use as the presentation target from the SafariWebExtensionHandler.

Trying to use the navigator.credentials.create JS API (which is the preferred method, frankly, in a web extension) results in the following error:

NotAllowedError: The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission.

Chrome has a great solution for this that I believe should be adopted by Safari. If an extension has host permissions for a relying party it wants to claim, or if it has an associated domain entitlement for it, webauthn operations should be allowed.

Boost

Answer 1

Systems Engineer OP

Apple

May ’25

This is an interesting idea. Can you please file this as a feature request in Feedback Assistant? We'd love to hear more about what exactly you're trying to achieve.

1

Answer 2

tylerdurden101390 OP

14h

Mozilla will be landing this change in Firefox soon: https://bugzilla.mozilla.org/show_bug.cgi?id=1956484. Chromium already supports this behavior, as I already noted in the original request. It would be great to get parity across the extension platforms and continue to promote passkeys as the preferred authentication mechanism over passwords.

Just to clarify the functionality being requested: Safari extensions should be able to create and use passkeys for domains that they are associated with or have host permissions for. So, for example, instead of only being able to use passkeys bound to a ephemeral Safari Extension origin (i. e. safari-web-extension://UUID), to use passkeys bound to the company's domain (i. e. example.com).

I've yet to hear back in Feedback Assistant. How can I better escalate this feature request?

1