W3C advances WebAuthn Level 4 with first public working draft

The World Wide Web Consortium (W3C) Web Authentication Working Group published the first public working draft of Web Authentication: An API for accessing Public Key Credentials Level 4 on 15 September 2026.

The draft sets out how web applications can create and use strong, attested public key credentials to authenticate users. Each credential is associated with a specific WebAuthn Relying Party, allowing it to be used within a defined scope.

Under the proposed model, authenticators create and hold the public key credentials at the request of web applications. The user agent mediates access between websites and authenticators, with the aim of preserving user privacy.

The draft also defines responsibilities for authenticators. They must ensure that operations are carried out only with user consent and can provide cryptographic proof of their properties to Relying Parties through attestation.

In addition, the specification describes the functional model for WebAuthn-compliant authenticators, including their signature and attestation capabilities. It also outlines changes introduced since Web Authentication Level 3.

What is the draft about?

In simple terms, WebAuthn is a web standard for signing users in without relying solely on passwords. It allows a website to use a cryptographic credential stored by an authenticator, such as a security key or a device-based authenticator, to verify a user.

The Level 4 draft continues to develop this model. It describes how websites, browsers and authenticators interact when creating and using these public key credentials, while addressing user consent, privacy, credential scope, and cryptographic attestation.

Importantly, this is a First Public Working Draft, so it is a draft specification rather than a final W3C standard.