WebAuthn Level 3: what it means for hospital sign-in controls

TL;DR: WebAuthn Level 3 formalises related origins, PRF-derived secrets, signal APIs and conditional creation, according to Crayonic, giving hospital identity teams a standardised basis for cross-domain passkeys, leaver handling and background migration. The governance shift is that policy can now assume browser and authenticator support is predictable enough to manage shared-device sign-in deliberately, not opportunistically.

Editorial analysis by NHI Mgmt Group, based on content published by Crayonic: “WebAuthn Level 3 is final. Five changes that matter for hospital sign-in.”.

By the numbers:

• Chrome has supported PRF since 116, Safari since 18.0 and Firefox fully since 139, according to Crayonic.
• Chrome shipped the Signal API on desktop in 132 and on Android in 144, according to Crayonic.
• Chrome added conditional create on desktop in 136 and on Android in 142, according to Crayonic.

Key questions

Q: How should organisations govern passkeys across multiple domains?

A: They should treat cross-domain passkey use as a formal trust boundary, not a convenience feature.

Q: Why do passwordless programmes still need strong lifecycle governance?

A: Passwordless shifts risk from passwords to issuance, recovery, and revocation.

Q: When should teams use authenticator-derived secrets instead of normal sign-in?

A: Use them when the goal is to unlock specific data only after user verification, especially on shared devices or in mixed-trust clinical workflows.

Practitioner guidance

• Define an origin governance model List every domain that may legitimately share a passkey, approve the related origins file process, and assign ownership for change control and review.
• Separate sign-in success from data access design If you use PRF-derived secrets, document exactly which data a clinician-authenticated secret may unlock and where server-side recovery is intentionally disallowed.
• Align offboarding with credential signalling Update leaver workflows so browser-side passkey prompts and server-side account state are reconciled after deletion, not left to user memory.

Bottom line: WebAuthn Level 3 shifts passkey governance toward explicit control of cross-domain trust, lifecycle state and authenticator-dependent access.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →