PublicKeyCredential: toJSON() method
Baseline
2025
Newly available
Since March 2025, this feature works across the latest devices and browser versions. This feature might not work in older devices or browsers.
Secure context: This feature is available only in secure contexts (HTTPS), in some or all supporting browsers.
The toJSON() method of the PublicKeyCredential interface returns a JSON type representation of a PublicKeyCredential.
The properties of the returned object depend on whether the credential is returned by navigator.credentials.create() when creating a key pair and registering a user, or navigator.credentials.get() when authenticating a user.
This method is automatically invoked when web app code calls JSON.stringify() to serialize a PublicKeyCredential so that it can be sent to relying party server when registering or authenticating a user.
It not intended to be called directly in web app code.
Syntax
toJSON()
Parameters
None.
Return value
A JSON type representation of a PublicKeyCredential object.
The included properties depend on whether the credential was returned by navigator.credentials.create() on registration, or navigator.credentials.get() when authenticating a user.
The values and types of included properties are the same as for PublicKeyCredential, with the exception that base64url-encoded strings are used in place of buffer properties.
The object properties are:
id-
The value returned by
PublicKeyCredential.id. rawId-
A base64url-encoded version of
PublicKeyCredential.rawId. authenticatorAttachmentOptional-
The value returned by
PublicKeyCredential.authenticatorAttachment. type-
The string
"public-key". clientExtensionResults-
An array containing base64url-encoded versions of the values returned by
PublicKeyCredential.getClientExtensionResults(). response-
The response property object depends on whether the credentials are returned following a registration or authentication operation.
-
When registering a new user
responsewill be a JSON-type representation ofAuthenticatorAttestationResponsewhere buffer values have been base64url encoded. -
When authenticating a user the returned value will be a JSON-type representation version of
AuthenticatorAssertionResponsewhere buffer values have been base64url encoded.
-
Exceptions
SecurityErrorDOMException-
The RP domain is not valid.
Examples
When registering a new user, a relying party server will supply information about the expected credentials to the web app.
The web app calls navigator.credentials.create() with the received information (createCredentialOptions below), which returns a promise that fulfills with the new credential (a PublicKeyCredential).
const newCredentialInfo = await navigator.credentials.create({
createCredentialOptions,
});
The web app then serializes the returned credential using JSON.stringify() (which in turn calls toJSON()) and posts it back to the server.
const registration_url = "https://example.com/registration";
const apiRegOptsResp = await fetch(registration_url, {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify(newCredentialInfo), // Calls newCredentialInfo.toJSON
});
Specifications
| Specification |
|---|
| Web Authentication: An API for accessing Public Key Credentials - Level 3 # dom-publickeycredential-tojson |
Browser compatibility
Loading…