Implement Stytch passkeys registration and authentication in a web application

Steps

1. Install the Stytch browser SDK; initialize the Stytch client with your public token.
2. For registration, call stytch.passkeys.register({ user_id }) (or the equivalent SDK method); the SDK fetches the challenge from Stytch's backend, calls navigator.credentials.create, and sends the attestation to Stytch — you do not manage the ceremony directly.
3. For authentication, call stytch.passkeys.authenticate(); the SDK fetches a challenge, calls navigator.credentials.get, and sends the assertion to Stytch, returning a session token on success.
4. Stytch returns a Stytch session (session_token and session_jwt) on successful passkey authentication; use this session for subsequent authenticated API calls.
5. To list or revoke a user's registered passkeys, call the Stytch backend API (server-side with your secret key) GET /v1/users/{user_id} and inspect the webauthn_registrations array; delete via DELETE /v1/webauthn/registrations/{webauthn_registration_id}.