Candidate Recommendation Snapshot: Web Authentication: An API for accessing Public Key Credentials - Level 3 (Call for Wide Review)

Web Authentication: An API for accessing Public Key Credentials - Level 3

https://www.w3.org/TR/2026/CR-webauthn-3-20260113/

feedback due by: February 10, 2026

Published by
 Web Authentication Working Group

Abstract

This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users. Conceptually, one or more public key credentials, each scoped to a given WebAuthn Relying Party, are created by and bound to authenticators as requested by the web application. The user agent mediates access to authenticators and their public key credentials in order to preserve user privacy. Authenticators are responsible for ensuring that no operation is performed without user consent. Authenticators provide cryptographic proof of their properties to Relying Parties via attestation. This specification also describes the functional model for WebAuthn conformant authenticators, including their signature and attestation functionality.

Status of the Document

This section describes the status of this document at the time of its publication. A list of current W3C publications and the latest revision of this technical report can be found in the W3C standards and drafts index. 

For the Web Authentication specification to move beyond Candidate Recommendation we must show two browser implementations supporting the new features and extensions. The spec will be run through the Level 3 on the Web Platform Tests. 

This document was published by the Web Authentication Working Group as a Candidate Recommendation Snapshot using the Recommendation track. 

Feedback and comments on this specification are welcome. Please use Github issues. Discussions may also be found in the public-webauthn@w3.org archives. 

Publication as a Candidate Recommendation does not imply endorsement by W3C and its Members. A Candidate Recommendation Snapshot has received wide review, is intended to gather implementation experience, and has commitments from Working Group members to royalty-free licensing for implementations. 

This is a draft document and may be updated, replaced or obsoleted by other documents at any time. It is inappropriate to cite this document as other than work in progress. 

This Candidate Recommendation is not expected to advance to Recommendation any earlier than 10 February 2026. 

This document was produced by a group operating under the W3C Patent Policy. W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent that the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy. 

This document is governed by the 18 August 2025 W3C Process Document.

-- 
This report was automatically generated using https://github.com/w3c/transition-notifier

Received on Tuesday, 13 January 2026 07:31:42 UTC