WebAuthn
The W3C browser API for registering and using public key credentials, the web half of FIDO2 alongside CTAP2.
WebAuthn exposes navigator.credentials.create() for registration and navigator.credentials.get() for authentication. The server sends a random challenge and its relying party ID; the authenticator returns signed client data (including origin) and authenticator data (RP ID hash, flags such as user present and user verified, a signature counter).
Server verification must check the challenge, origin, RP ID hash, the UV flag when your policy needs it, and the signature against the stored public key. Libraries handle the CBOR and COSE parsing; do not write it yourself.
Confusions: attestation (proving what model of authenticator made the key) is optional and mostly unneeded outside regulated settings; WebAuthn is the API, passkeys are the user-facing credential; CTAP2 is the protocol between browser and an external key.