# WebAuthn server library for public key-based authentication

**URL:** <https://discourse.haskell.org/t/webauthn-server-library-for-public-key-based-authentication/3976>\
**Category:** Announcements\
**Created:** [January 25, 2022, 3:25pm UTC](https://discourse.haskell.org/t/webauthn-server-library-for-public-key-based-authentication/3976 "2022-01-25T15:25:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Infinisil](https://sea2.discourse-cdn.com/flex002/user_avatar/discourse.haskell.org/infinisil/32/2224_2.png) [@Infinisil](https://discourse.haskell.org/u/Infinisil)\
**Post date:** [January 25, 2022, 3:25pm UTC](https://discourse.haskell.org/t/webauthn-server-library-for-public-key-based-authentication/3976/1 "2022-01-25T15:25:13Z")

</div>

[Tweag](https://www.tweag.io/) and [Mercury](https://mercury.com/) are happy to announce a server-side library for the the [WebAuthn](https://www.w3.org/TR/webauthn-2/) standard (part of the [FIDO2](https://fidoalliance.org/fido2/) project), available as [webauthn](https://hackage.haskell.org/package/webauthn) on Hackage! If you have a web server written in Haskell that allows users to create and log into accounts, this library might interest you, and we’d love to have feedback as we refine the interface of the library. The source of the library is available [here](https://github.com/tweag/webauthn), feel free to open issues, PRs or leave a comment here!

The WebAuthn standard allows users to easily and securely authenticate to websites with public key credentials, generated and stored on secure authenticators like Yubikeys, TouchID, TPM and more. This can either be used to secure accounts with second-factor authentication, or as a first factor, allowing users to log in without a password or even a username. See [here](https://webauthn.guide/) for a WebAuthn guide and demo. Here’s [another](https://fido2-net-lib.passwordless.dev/) and [another](https://webauthn.me/) demo.

Originally forked from a [hackathon project](https://github.com/arianvp/haskell-fido2) by [Arian](https://github.com/arianvp) and taking inspiration from an [alternative implementation](https://github.com/fumieval/webauthn) by [Fumiaki](https://github.com/fumieval) (also known as [webauthn-0](https://hackage.haskell.org/package/webauthn-0) on Hackage), this library has been developed by a team at [Tweag](https://www.tweag.io/), as contracted by [Mercury](https://mercury.com/), whose intention is to sponsor a good open-source library for the Haskell ecosystem, many thanks!

While the general design of the library isn’t expected to change very much, it should currently still be considered an alpha version, as Mercury and ideally others try out the library and give feedback. As such, if you have a website with user accounts running on Haskell, we’d love for you to try it out and tell us what could be improved! To get started, here are our recommendations:

- Read the [introduction to the WebAuthn standard](https://www.w3.org/TR/webauthn-2/#sctn-intro) to get a sense of what the standard does
- Read the documentation of the main [Crypto.WebAuthn](https://hackage.haskell.org/package/webauthn-0.1.1.0/docs/Crypto-WebAuthn.html) module, which gives an overview of the library
- Check out and run the code of our [demo server](https://github.com/tweag/webauthn/tree/master/server) implementation, which shows an example of how the library might be used
- Use [this chrome extension](https://github.com/google/virtual-authenticators-tab) to simulate authenticators if you don’t have one yourself