Skip to content

feat: add Passkey and MyAccount API support#927

Open
cschetan77 wants to merge 2 commits into
mainfrom
feat/passkey-and-myaccount-api
Open

feat: add Passkey and MyAccount API support#927
cschetan77 wants to merge 2 commits into
mainfrom
feat/passkey-and-myaccount-api

Conversation

@cschetan77

@cschetan77 cschetan77 commented Jun 24, 2026

Copy link
Copy Markdown

Summary

This PR adds support for the Passkey and MyAccount APIs to the auth0-angular SDK, exposing them as Observable-based clients on AuthService — consistent with how the existing mfa client is structured.

Passkey API (AuthService.passkey)

Wraps the passkey client from @auth0/auth0-spa-js. Both methods handle the full WebAuthn challenge-response flow internally:

  • passkey.signup(options) — register a new user with a passkey credential
  • passkey.login(options?) — authenticate an existing user via passkey assertion

Both methods call authState.refresh() on success so that isAuthenticated$ and user$ update automatically, consistent with other authentication flows in the SDK.

MyAccount API (AuthService.myAccount)

Wraps the myAccount client from @auth0/auth0-spa-js, providing Observable versions of all seven account management operations:

Method Description
getFactors() List factors and their enrollment status
getAuthenticationMethods(type?) List the user's enrolled authentication methods
getAuthenticationMethod(id) Get a single authentication method by ID
deleteAuthenticationMethod(id) Delete an authentication method
updateAuthenticationMethod(id, data) Update an authentication method (name, preferred phone method)
enrollmentChallenge(options) Start enrollment (step 1 of 2)
enrollmentVerify(options) Complete enrollment by verifying the challenge (step 2 of 2)

Other changes

  • ObservablePasskeyApiClient and ObservableMyAccountApiClient interfaces added to interfaces.ts, following the ObservableMfaApiClient pattern
  • All passkey and MyAccount error classes (PasskeyError, PasskeyRegisterError, PasskeyChallengeError, PasskeyGetTokenError, MyAccountApiError) and types re-exported from the public API surface
  • @auth0/auth0-spa-js minimum version bumped to ^2.21.0 where these APIs were introduced

Test plan

  • 31 new unit tests added to auth.service.spec.ts covering: correct delegation to the underlying SDK, expected return values, authState.refresh() called after passkey authentication, and error propagation for all methods
  • All 115 tests in auth.service.spec.ts pass (npm test -- --testPathPattern=auth.service.spec)

Usage

import { inject } from '@angular/core';
import { AuthService } from '@auth0/auth0-angular';

const auth = inject(AuthService);

// Passkey login — isAuthenticated$ and user$ update automatically on success
auth.passkey.login().subscribe(tokens => console.log(tokens.access_token));

// List enrolled authentication methods
auth.myAccount.getAuthenticationMethods().subscribe(methods => console.log(methods));

// Enroll a new TOTP authenticator (two-step flow)
auth.myAccount.enrollmentChallenge({ type: 'totp' }).pipe(
  switchMap(challenge =>
    auth.myAccount.enrollmentVerify({
      type: 'totp',
      location: challenge.location,
      auth_session: challenge.auth_session,
      otp_code: userEnteredOtp,
    })
  )
).subscribe(authMethod => console.log('Enrolled:', authMethod));

Expose `AuthService.passkey` and `AuthService.myAccount` as Observable-based
API clients, wrapping the corresponding clients from `@auth0/auth0-spa-js`.

- `passkey.signup()` and `passkey.login()` handle the full WebAuthn
  challenge-response flow and call `authState.refresh()` on success so that
  `isAuthenticated$` and `user$` update automatically.
- `myAccount` provides Observable wrappers for all seven MyAccount API
  operations: getFactors, getAuthenticationMethods, getAuthenticationMethod,
  deleteAuthenticationMethod, updateAuthenticationMethod, enrollmentChallenge,
  and enrollmentVerify.
- `ObservablePasskeyApiClient` and `ObservableMyAccountApiClient` interfaces
  added to `interfaces.ts`, consistent with the existing `ObservableMfaApiClient`
  pattern.
- All passkey and MyAccount error classes and types re-exported from the public
  API surface.
- Bump `@auth0/auth0-spa-js` minimum to `^2.21.0` where these APIs were
  introduced.
- 31 new unit tests covering delegation, return values, state side-effects, and
  error propagation for both API clients.
@cschetan77 cschetan77 requested a review from a team as a code owner June 24, 2026 08:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant