Supporting Passkeys in Shop's Authentication Flows - Shopify

This post details the integration of Passkeys into Shopify's existing authentication flows for Shop Pay and the Shop app. It explains the technical implementation of Passkey registration and login using the `webauthn-ruby` gem, including the use of `WebAuthn::Credential.options_for_create` and `WebAuthn::RelyingParty.verify_registration` for registration, and `WebAuthn::RelyingParty.verify_authentication` for login. Key learnings include subdomain handling, specifying `authenticator_selection` and `require_resident_key`, and challenge verification for replay attack protection. The post also discusses the future potential of Conditional UI for Passkeys.