<script> // 1. Get the challenge from your server (Base64URL encoded) async function startLogin() const resp = await fetch('/webauthn/login-challenge'); const challenge, allowCredentials = await resp.json();

Simply de‑provision the user in your IdP; the key is automatically revoked in the console, rendering it unusable.

// 2. Convert to Uint8Array objects const publicKey = challenge: Uint8Array.from(atob(challenge), c => c.charCodeAt(0)), allowCredentials: allowCredentials.map(cred => ( type: 'public-key', id: Uint8Array.from(atob(cred.id), c => c.charCodeAt(0)), transports: cred.transports )) ;

All Fortect Key models meet an IP67 rating—safe from accidental spills and dust.

// 3. Call the browser API – the Fortect Key will be presented as an option const assertion = await navigator.credentials.get( publicKey );

Absolutely. The Management Console lets you enable multi‑factor policies that require both a TOTP and the hardware key for high‑risk actions.

// 4. Send the signed assertion back to the server for verification const data = id: assertion.id, rawId: btoa(String.fromCharCode(...new Uint8Array(assertion.rawId))), response: authenticatorData: btoa(String.fromCharCode(...new Uint8Array(assertion.response.authenticatorData))), clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(assertion.response.clientDataJSON))), signature: btoa(String.fromCharCode(...new Uint8Array(assertion.response.signature))), userHandle: assertion.response.userHandle ? btoa(String.fromCharCode(...new Uint8Array(assertion.response.userHandle))) : null , type: assertion.type ;

Fortect Key May 2026

<script> // 1. Get the challenge from your server (Base64URL encoded) async function startLogin() const resp = await fetch('/webauthn/login-challenge'); const challenge, allowCredentials = await resp.json();

Simply de‑provision the user in your IdP; the key is automatically revoked in the console, rendering it unusable. fortect key

// 2. Convert to Uint8Array objects const publicKey = challenge: Uint8Array.from(atob(challenge), c => c.charCodeAt(0)), allowCredentials: allowCredentials.map(cred => ( type: 'public-key', id: Uint8Array.from(atob(cred.id), c => c.charCodeAt(0)), transports: cred.transports )) ; &lt;script&gt; // 1

All Fortect Key models meet an IP67 rating—safe from accidental spills and dust. Convert to Uint8Array objects const publicKey = challenge:

// 3. Call the browser API – the Fortect Key will be presented as an option const assertion = await navigator.credentials.get( publicKey );

Absolutely. The Management Console lets you enable multi‑factor policies that require both a TOTP and the hardware key for high‑risk actions.

// 4. Send the signed assertion back to the server for verification const data = id: assertion.id, rawId: btoa(String.fromCharCode(...new Uint8Array(assertion.rawId))), response: authenticatorData: btoa(String.fromCharCode(...new Uint8Array(assertion.response.authenticatorData))), clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(assertion.response.clientDataJSON))), signature: btoa(String.fromCharCode(...new Uint8Array(assertion.response.signature))), userHandle: assertion.response.userHandle ? btoa(String.fromCharCode(...new Uint8Array(assertion.response.userHandle))) : null , type: assertion.type ;