Note: This is experimental software. It is probably not stable nor secure. Don't use it in production!

See Issues for the closest thing we have to a roadmap.

brew install mkcert
mkcert -install
mkcert -cert-file=dev-cert.pem -key-file=dev-key.pem localhost

Create a configuration file (e.g., etc/config.hujson) based on the example:

On the server host:

go run ./cmd/passidp \
  --config=etc/dev-config.hujson \
  --credential-store-path=data/credentials.json \
  --state-path=data/state.sqlite \
  serve \
  --cert-file=dev-cert.pem \
  --key-file=dev-key.pem \
  --listen-addr=localhost:8085

# Test with OIDC example RP
go run lds.li/oauth2ext/cmd/oidc-example-rp@latest

# Test with OIDC CLI
go run lds.li/oauth2ext/cmd/oidccli@latest \
  -issuer=https://localhost:8085 \
  -client-id=cli \
  info

add-credential writes a pending enrollment into the SQLite state database (--state-path). The running server stores the passkey in credentials.json when registration finishes.

Create a short-lived enrollment URL (15 minutes by default), then complete WebAuthn registration in the browser. The passkey is stored as soon as registration succeeds.

go run ./cmd/passidp \
  --config=etc/dev-config.hujson \
  --state-path=data/state.sqlite \
  add-credential \
  --user-id=da5b51ac-0efd-4631-8790-9f02d516527c

Pass --validity=1h to keep the URL open longer.

This will output:

Enrollment ID: 123e4567-e89b-12d3-a456-426614174000
Enrollment Key: 987fcdeb-51a2-43f1-9b8c-123456789abc
Valid until: 2025-01-15T10:45:00Z
Enroll at: https://localhost:8085/registration?enrollment_token=987fcdeb-51a2-43f1-9b8c-123456789abc&user_id=da5b51ac-0efd-4631-8790-9f02d516527c

Open the enrollment URL, name the key, and register a passkey. The server must be running so it can write the new credential.

TEST_E2E=true go test -v ./e2e -count=1 -run TestE2E