Supporting Passkeys in Shop's Authentication Flows - Shopify

What this post added

This post details the integration of Passkeys into Shopify's authentication flows for Shop and Shop Pay. It explains the technical implementation of Passkey registration and login using the webauthn-ruby gem, including the use of `WebAuthn::Credential.options_for_create` and `WebAuthn::RelyingParty.verify_registration` for registration, and `WebAuthn::RelyingParty.verify_authentication` for login. Key learnings include handling subdomains, specifying authenticator selection and discoverable credentials, and protecting against replay attacks by saving and verifying challenges. The post also discusses the potential of Conditional UI for passkeys.