Any way to natively use macOS passkeys

[AdityaGarg8]

Hi

Like Windows, it would be awesome if passkey support for macOS system wide passkeys (like iCloud Keychain) could be possible as well.

[mkalioby]

What is the type of the application you want to n use passkeys with on Mac OSX?

[AdityaGarg8]

What is the type of the application you want to n use passkeys with on Mac OSX?

I use a python script to send emails for ProtonMail accounts. I wanted to implement passkey support in the authentication of ProtonMail. I was successful in getting the Windows API to work, it successfully asked me to scan the QR code and passed the passkey to the ProtonMail server. Needed something like that for macOS as well.

https://github.com/AdityaGarg8/git-credential-email/blob/main/git-protonmail#L876

[AdityaGarg8]

	def _perform_platform_assertion(self, fido2_info: dict) -> dict:
		from fido2.client.windows import WindowsClient
		from fido2.client import DefaultClientDataCollector
		from fido2.webauthn import PublicKeyCredentialRequestOptions, PublicKeyCredentialDescriptor
		import base64

		public_key = fido2_info['AuthenticationOptions']['publicKey']

		options = PublicKeyCredentialRequestOptions(
			challenge=bytes(public_key['challenge']),
			rp_id=public_key['rpId'],
			timeout=public_key['timeout'],
			user_verification=public_key['userVerification'],
			allow_credentials=[
				PublicKeyCredentialDescriptor(
					type=cred['type'],
					id=bytes(cred['id']),
				)
				for cred in public_key['allowCredentials']
			],
		)

		client = WindowsClient(
			client_data_collector=DefaultClientDataCollector("https://account.proton.me")
		)

		result = client.get_assertion(options)
		response = result.get_response(0)  # AuthenticationResponse
		assertion = response.response      # AuthenticatorAssertionResponse

		return {
			'AuthenticationOptions': fido2_info['AuthenticationOptions'],
			'ClientData': base64.b64encode(bytes(assertion.client_data)).decode(),
			'AuthenticatorData': base64.b64encode(bytes(assertion.authenticator_data)).decode(),
			'Signature': base64.b64encode(assertion.signature).decode(),
			'CredentialID': list(response.raw_id),
		}

This is what works for me on Windows regarding my app.