Credentials for Linux: Bringing Passkeys to the Linux desktop#

Alfie Fresta, Martin Sirringhaus

• Why: Windows, macOS, Android, and iOS all have platform FIDO2 APIs; Linux has none, leaving browsers and sandboxed apps with no standard way to do passkeys. This is the cross-desktop effort to fix it, with working code.
• What: Two components: libwebauthn (a Rust FIDO2/U2F platform library with pluggable transports — USB HID, BLE, NFC, and hybrid/QR "caBLE" all supported today, TPM 2.0 platform authenticator planned) and credentialsd (a D-Bus service and proposed XDG portal for credential management, with a reference UI, a Firefox web extension, a patched Flatpak Firefox build, and Fedora/openSUSE packages).
• How: The portal design separates frontend (protocols, devices, credential providers) from backend (trusted UX prompt owned by the desktop environment), request verification in portal style, and integration work is underway with xdg-desktop-portal (WIP PR) plus Chromium/Firefox/WebKit/Servo. The hard open problems are Linux-specific: origin scoping (how do you determine the requesting origin?) and app identity verification (Linux has no app signing keys, unlike Android/iOS), leading to a privileged-vs-unprivileged API split.
• Where applicable: Desktop Linux identity broadly — distro engineers, browser maintainers, and anyone whose passkey strategy must include Linux clients. Third-party credential providers (Bitwarden is among the contributors) are an explicit design goal.