Skip to content
mera
Get startedGetting started →

createSecretVaultWithExistingPasskey

Evaluates an existing passkey and encrypts one secret into a vault. Runs one navigator.credentials.get() ceremony.

Import

Section titled “Import”
import { createSecretVaultWithExistingPasskey } from "@category-labs/mera";

Usage

Section titled “Usage”
import {
  createSecretVaultWithExistingPasskey,
  parseSecretVault,
} from "@category-labs/mera";


const existing = parseSecretVault(localStorage.getItem("vault"));
const secret = new TextEncoder().encode("another secret");
try {
  const vault = await createSecretVaultWithExistingPasskey({
    rpId: "account.example.com",
    credential: existing.credential,
    secret,
  });
  localStorage.setItem("second-vault", JSON.stringify(vault));
} finally {
  secret.fill(0);
}

Parameters

Section titled “Parameters”

options is a CreateSecretVaultWithExistingPasskeyOptions.

options.rpId

Section titled “options.rpId”
  • Type: string
  • Required

Relying party ID for the WebAuthn assertion. It must match the ID under which the passkey was created.

options.credential

Section titled “options.credential”
  • Type: PasskeyCredentialMetadata
  • Optional; when omitted, WebAuthn may choose any discoverable credential for the relying party

Credential metadata that restricts the assertion to one passkey. Reported transports are retained in the new vault when the selected credential matches.

options.secret

Section titled “options.secret”
  • Type: Uint8Array
  • Required

Secret bytes to encrypt. Any non-empty length.

options.timeout

Section titled “options.timeout”
  • Type: number
  • Optional; browser defaults apply when omitted

WebAuthn timeout in milliseconds.

Returns

Section titled “Returns”

Promise<PasskeySecretVault>: a JSON-safe vault with the selected credential’s metadata and a fresh random 32-byte PRF salt. The secret vault format page documents every field.

Errors

Section titled “Errors”
  • PRF_UNAVAILABLE: the authenticator did not return a usable 32-byte PRF output.
  • INPUT_INVALID: secret is empty, or credential.credentialId is empty or not canonical base64url.
  • CRYPTO_UNAVAILABLE: the page is not in a secure context, or the runtime lacks Web Crypto.
  • PASSKEY_OPERATION_FAILED: WebAuthn is unavailable, cancelled, or returns an unexpected credential.

See also

Section titled “See also”