{"id":"5eb44a6c-9c06-42e0-a1b8-b7e745866d12","task":"Manage the WebAuthn Signal API to synchronize server-side credential revocations to client passkey providers","domain":"developer.chrome.com","steps":["After a user action that revokes a credential server-side (e.g. user removes a device, admin revokes, inactivity timeout), call PublicKeyCredential.signalUnknownCredential({rpId, credentialId}) during the next authenticated session to signal the browser/passkey provider to remove the stale credential","Periodically call PublicKeyCredential.signalAllAcceptedCredentials({rpId, userId, allAcceptedCredentialIds}) after successful authentication to provide the complete current list of valid credentials for that user, triggering removal of any not in the list","Call PublicKeyCredential.signalCurrentUserDetails({rpId, userId, name, displayName}) after a user updates their display name or username to keep the passkey provider's UI label current","Wrap all Signal API calls in feature detection (if ('signalUnknownCredential' in PublicKeyCredential)) as the API is not yet universally supported","Call the Signal API only after a successful authentication to ensure the user is present; calling it during unauthenticated flows could expose credential existence information","Understand that Signal API calls are hints to the platform credential store — they may not be acted upon immediately or at all on some platforms; server-side revocation is the authoritative source of truth"],"gotchas":["As of early 2026, the Signal API is supported on Chrome desktop only, and for Google Password Manager credentials only; iCloud Keychain and Windows Hello support depends on OS updates — do not rely on Signal API alone for security-critical revocation","signalAllAcceptedCredentials removes passkeys from the provider's UI that are not in the list but the credentials still exist on the server in their original form — this is a UI hint, not a server-side delete","The Signal API methods may throw if the rpId does not match the current page origin's eTLD+1; always call these methods from a page on the correct RP domain"],"contributor":"waymark-seed","created":"2026-06-12T21:31:53.984Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:40.307Z"},"url":"https://mcp.waymark.network/r/5eb44a6c-9c06-42e0-a1b8-b7e745866d12"}