api.PublicKeyCredential - missing platform-specific compatibility for desktop operating systems

What type of issue is this?

Missing compatibility data

What information was incorrect, unhelpful, or incomplete?

WebAuthn's supported features depend on both the browser and the platform/OS it's running on, even on desktop platforms.

Current compatibility data flags this as "desktop vs. Android vs. iOS", but "desktop" needs to be split further for at least BSD + Linux, macOS and Windows.

Passkey managers that provide browser extensions (rather than platform-level plugins) monkey-patch navigator.credentials.create and navigator.credentials.get, which entirely bypasses everything a browser does. This can cause completely different behaviour to the usual browser X platform.

For a user and developer, this can cause inconsistent behaviour between platforms, and also whether or not you have a passkey manager browser extension installed.

This is also an issue with the MDN content itself, but a first step would be to expand the matrix to include different desktop platforms.

What browsers does this problem apply to, if applicable?

• Chromium on Linux
• Chromium on macOS
• Firefox on BSD
• Firefox on Linux
• Firefox on Solaris
• Browsers that use iOS and iPadOS platform APIs
• Browsers that use macOS' platform APIs (Firefox, Safari)
• Browsers that use Windows' platform APIs

What did you expect to see?

Some examples of platform-specific support issues:

• Firefox on BSD and Linux only support USB authenticators, because authenticator-rs only supports USB, and there are no platform APIs (like on macOS and Windows).

  Chrome on Linux supports Google Password Manager, caBLE and USB authenticators.

• Firefox on Solaris has WebAuthn APIs available, but they don't work at all, because authenticator-rs doesn't support Solaris.

• Windows 10 v1903 and later completely block direct access to CTAP/FIDO authenticators, and enforces use of its platform APIs. Each version of Windows has different levels of WebAuthn support, and this is sometimes backported to older release branches.

  These APIs support at least TPM, USB, NFC, smartcard and BTLE authenticators. They also work over RDP sessions. On Windows 11, it also supports caBLE authenticators and passkey manager plugins.

• Firefox and Safari on macOS use macOS WebAuthn APIs for all requests. This supports iCloud Keychain, passkey manager plugins, caBLE and USB.

  Chrome on macOS only offers to use the macOS APIs for access to iCloud Keychain, and uses its own implementation for caBLE and USB authenticators.

• Browsers on iOS support USB-C (or Lightning, on older devices), NFC (where applicable) and smartcard (via a USB CCID ISO7816-3 adapter) authenticators, iCloud Keychain, and passkey manager plugins.

• If a credential creation request contains ES256 as a supported algorithm, Chromium on Linux and macOS will always use it, regardless of preference order.

• Chromium on Linux and macOS don't implement userVerification: preferred correctly, and will not use user verification with authenticators that support it, but are unconfigured.

  macOS platform APIs have the same issue, which affects Firefox and Safari.

  Firefox on BSD and Linux don't implement userVerification: preferred | required correctly, skipping user verification with authenticators that support it, but are unconfigured.

  Windows 11 implements these steps correctly.

• Firefox on BSD and Linux won't offer to set a PIN on an authenticator during a registration or authentication ceremony if needed. It also has no way to manage authenticator configuration. Chromium on Linux handles this correctly.

• Many passkey manager browser extensions and platform plugins falsify the "user verification" bit, so their passkeys are effectively only a single-factor credential ("something you know"). These are typically unattested (or not verifiable with FIDO MDS), making detection pretty easy.

Did you test this? If so, how?

Manually with https://demo.yubico.com/webauthn-developers

Can you link to any release notes, bugs, pull requests, or MDN pages related to this?

Bugs referenced inline. MDN page for this is https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

Do you have anything more you want to share?

No response

MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API

MDN metadata

MDN page report details

• Query: api.PublicKeyCredential
• Report started: 2026-09-17T05:42:27.326Z

Start with the BCD entry queried as api.PublicKeyCredential and review how the MDN Web Authentication API page represents desktop compatibility. Use the listed browser and operating-system cases and linked vendor references to define the platform split, then validate the resulting matrix against the reported examples and demo.yubico.com.