u2f-api is a client-side JavaScript library that provides a promisified interface for interacting with the Universal 2nd Factor (U2F) API in web browsers. It aims to abstract away browser-specific implementations of U2F, offering support for Chrome (including its historical extension methods), Opera, and Firefox 58+ (though with some caveats regarding multi-domain registrations). The library provides core functions such as `register()` and `sign()` for managing U2F security keys, alongside `isSupported()` and `ensureSupport()` for client capability detection. The current stable version is 1.2.1, released in January 2021. Its release cadence is infrequent, suggesting a maintenance-only status. A key differentiator is its modern Promise-based API and its efforts to normalize U2F interactions across different browsers, but it's crucial to understand that U2F itself is largely a legacy standard, with WebAuthn being the modern successor for FIDO authentication. This library requires a complementary server-side implementation (e.g., using the `u2f` npm package) to function fully.
npm install u2f-apiVerified import paths — ran on the pinned version, not inferred.
Demonstrates a full client-side U2F workflow, including checking for browser support, initiating a registration ceremony, and performing a sign-in (authentication) using mock server responses.
Ensure your application relies on native Promises or polyfills them globally if targeting older environments. Remove any custom Promise injections.
For new implementations, investigate FIDO2/WebAuthn libraries (e.g., `fido2-lib` for server-side) instead of U2F. Consider a phased migration strategy for existing U2F users to WebAuthn.
Always use `isSupported()` or `ensureSupport()` before attempting U2F operations. Provide fallback authentication methods or inform users about browser compatibility requirements.
Integrate with a server-side U2F library (e.g., the `u2f` npm package) to handle cryptographic challenge generation and response verification. Ensure secure communication between client and server.
Increase the `timeout` parameter in `register()` or `sign()` calls (specified in seconds). Advise users to quickly interact with their security key when prompted. Ensure the U2F device is properly connected and functioning.
Verify that the `signRequests` array contains correct and current key handles associated with the user. Ensure the user is presenting the correct U2F device. This error can also occur if the device has an internal error.
If using a script tag, ensure `bundle.js` is loaded before your application code, and access methods via `window.u2fApi`. If using a bundler, ensure you have `import u2fApi from 'u2f-api'` or specific named imports like `import { register } from 'u2f-api'`.