WebAuthn Credential Lifecycle and Revocation in Safari

WebAuthn Credential Management

Safari implements WebAuthn credentials scoped to the eTLD+1 to enforce least-privilege access, ensuring that credentials remain origin-bound. These keys are stored within the Secure Enclave or iCloud Keychain for multi-device synchronization.

Credential Expiration Constraints

The WebAuthn specification does not define a native expiration field, and Safari provides no built-in mechanism to notify users of expired credentials or to automatically purge them based on a timeframe. Consequently, the responsibility for lifecycle management rests entirely with the relying party (RP).

Revocation Uncertainty

There is currently no standardized signaling method for a relying party to trigger the removal of a specific credential from the browser's storage. Even after an RP revokes a credential on the server side, Safari may continue to present that credential as an authentication option to the user until the RP rejects the signature during the ceremony.

• How can a relying party effectively signal the browser to remove a revoked credential to prevent redundant authentication attempts?
• Is there a documented method to implement user-facing expiration alerts within Safari's native WebAuthn UI?