PublicKeyCredential: toJSON() method
Baseline 2025
Newly available
Since March 2025, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.
Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The toJSON() method of the PublicKeyCredential interface returns a JSON-serializable plain object representing the PublicKeyCredential object.
The method is automatically called by JSON.stringify() when a PublicKeyCredential object is encountered during JSON serialization.
Syntax
toJSON()
Parameters
None.
Return value
A JSON-serializable plain object containing the following properties:
authenticatorAttachmentOptional: not present if its value isnullclientExtensionResults: a JSON-serializable object representing the values returned bygetClientExtensionResults(), with buffer values encoded as base64url stringsidrawId: encoded as a base64url stringresponse: a JSON-serializable object representing theAuthenticatorResponsevalue, with buffer values encoded as base64url strings. Namely:- When it's a
AuthenticatorAssertionResponse, contains the following properties:authenticatorDataclientDataJSONsignatureuserHandleOptional: not present if its value isnull
- When it's a
AuthenticatorAttestationResponse, contains the following properties:attestationObjectauthenticatorData: the value returned bygetAuthenticatorData()clientDataJSONpublicKeyOptional: the value returned bygetPublicKey(), omitted if it isnullpublicKeyAlgorithm: the value returned bygetPublicKeyAlgorithm()transports: the value returned bygetTransports()
- When it's a
type
Unless stated otherwise, each property's value is copied as-is.
Exceptions
SecurityErrorDOMException-
The RP domain is not valid.
Examples
Calling toJSON() directly
When registering a new user, a relying party server will supply information about the expected credentials to the web app.
The web app calls navigator.credentials.create() with the received information (createCredentialOptions below), which returns a promise that fulfills with the new credential (a PublicKeyCredential).
Calling toJSON() directly returns a plain object. Its properties have the same values as the corresponding properties of the original object.
const credential = await navigator.credentials.create({
publicKey: createCredentialOptions,
});
const json = credential.toJSON();
console.log(json); // A plain object
console.log(typeof json); // "object"
console.log(json.id); // Same value as credential.id
Serializing to a JSON string
The returned credential is serialized using JSON.stringify(), which calls the toJSON() method automatically. The web app posts the serialized credential back to the server.
const jsonString = JSON.stringify(credential);
console.log(jsonString);
const registrationURL = "https://example.com/registration";
const apiRegOptsResp = await fetch(registrationURL, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: jsonString,
});
This would log a JSON string like so (formatted for readability):
{
"authenticatorAttachment": "platform",
"clientExtensionResults": {},
"id": "...",
"rawId": "...",
"response": {
"attestationObject": "...",
"authenticatorData": "...",
"clientDataJSON": "...",
"publicKey": "...",
"publicKeyAlgorithm": -7,
"transports": ["internal"]
},
"type": "public-key"
}
The base64url-encoded values are abbreviated as "..." for readability.
Specifications
| Specification |
|---|
| Web Authentication: An API for accessing Public Key Credentials - Level 4 # dom-publickeycredential-tojson |