Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Okta Provider
  4. API Docs
  5. AuthenticatorMethodWebauthn
Viewing docs for Okta v6.9.0
published on Wednesday, Jul 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-okta

okta.AuthenticatorMethodWebauthn

okta logo
Viewing docs for Okta v6.9.0
published on Wednesday, Jul 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-okta

    WARNING: This feature is only available as a part of the Identity Engine. Contact support for further information.

    Manages the WebAuthn authenticator method settings, including AAGUID group allowlists, user verification preferences, and passkey configuration.

    Note: This resource manages the settings of an existing WebAuthn authenticator method. The method itself cannot be created or deleted — it exists as part of the authenticator. On destroy, settings are reset to defaults.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";

const webauthn = okta.getAuthenticator({
    key: "webauthn",
});
const example = new okta.AuthenticatorMethodWebauthn("example", {
    authenticatorId: webauthn.then(webauthn => webauthn.id),
    userVerification: "PREFERRED",
    attachment: "ANY",
    allowSyncablePasskeys: true,
    aaguidGroups: [{
        name: "YubiKeys",
        aaguids: ["cb69481e-8ff7-4039-93ec-0a2729a154a8"],
    }],
});

    import pulumi
import pulumi_okta as okta

webauthn = okta.get_authenticator(key="webauthn")
example = okta.AuthenticatorMethodWebauthn("example",
    authenticator_id=webauthn.id,
    user_verification="PREFERRED",
    attachment="ANY",
    allow_syncable_passkeys=True,
    aaguid_groups=[{
        "name": "YubiKeys",
        "aaguids": ["cb69481e-8ff7-4039-93ec-0a2729a154a8"],
    }])

    package main

import (
	"github.com/pulumi/pulumi-okta/sdk/v6/go/okta"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		webauthn, err := okta.GetAuthenticator(ctx, &okta.LookupAuthenticatorArgs{
			Key: pulumi.StringRef("webauthn"),
		}, nil)
		if err != nil {
			return err
		}
		_, err = okta.NewAuthenticatorMethodWebauthn(ctx, "example", &okta.AuthenticatorMethodWebauthnArgs{
			AuthenticatorId:       pulumi.String(webauthn.Id),
			UserVerification:      pulumi.String("PREFERRED"),
			Attachment:            pulumi.String("ANY"),
			AllowSyncablePasskeys: pulumi.Bool(true),
			AaguidGroups: okta.AuthenticatorMethodWebauthnAaguidGroupArray{
				&okta.AuthenticatorMethodWebauthnAaguidGroupArgs{
					Name: pulumi.String("YubiKeys"),
					Aaguids: pulumi.StringArray{
						pulumi.String("cb69481e-8ff7-4039-93ec-0a2729a154a8"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Okta = Pulumi.Okta;

return await Deployment.RunAsync(() => 
{
    var webauthn = Okta.GetAuthenticator.Invoke(new()
    {
        Key = "webauthn",
    });

    var example = new Okta.AuthenticatorMethodWebauthn("example", new()
    {
        AuthenticatorId = webauthn.Apply(getAuthenticatorResult => getAuthenticatorResult.Id),
        UserVerification = "PREFERRED",
        Attachment = "ANY",
        AllowSyncablePasskeys = true,
        AaguidGroups = new[]
        {
            new Okta.Inputs.AuthenticatorMethodWebauthnAaguidGroupArgs
            {
                Name = "YubiKeys",
                Aaguids = new[]
                {
                    "cb69481e-8ff7-4039-93ec-0a2729a154a8",
                },
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.okta.OktaFunctions;
import com.pulumi.okta.inputs.GetAuthenticatorArgs;
import com.pulumi.okta.AuthenticatorMethodWebauthn;
import com.pulumi.okta.AuthenticatorMethodWebauthnArgs;
import com.pulumi.okta.inputs.AuthenticatorMethodWebauthnAaguidGroupArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var webauthn = OktaFunctions.getAuthenticator(GetAuthenticatorArgs.builder()
            .key("webauthn")
            .build());

        var example = new AuthenticatorMethodWebauthn("example", AuthenticatorMethodWebauthnArgs.builder()
            .authenticatorId(webauthn.id())
            .userVerification("PREFERRED")
            .attachment("ANY")
            .allowSyncablePasskeys(true)
            .aaguidGroups(AuthenticatorMethodWebauthnAaguidGroupArgs.builder()
                .name("YubiKeys")
                .aaguids("cb69481e-8ff7-4039-93ec-0a2729a154a8")
                .build())
            .build());

    }
}

    resources:
  example:
    type: okta:AuthenticatorMethodWebauthn
    properties:
      authenticatorId: ${webauthn.id}
      userVerification: PREFERRED
      attachment: ANY
      allowSyncablePasskeys: true
      aaguidGroups:
        - name: YubiKeys
          aaguids:
            - cb69481e-8ff7-4039-93ec-0a2729a154a8
variables:
  webauthn:
    fn::invoke:
      function: okta:getAuthenticator
      arguments:
        key: webauthn

    pulumi {
  required_providers {
    okta = {
      source = "pulumi/okta"
    }
  }
}

data "okta_getauthenticator" "webauthn" {
  key = "webauthn"
}

resource "okta_authenticatormethodwebauthn" "example" {
  authenticator_id        = data.okta_getauthenticator.webauthn.id
  user_verification       = "PREFERRED"
  attachment              = "ANY"
  allow_syncable_passkeys = true
  aaguid_groups {
    name    = "YubiKeys"
    aaguids = ["cb69481e-8ff7-4039-93ec-0a2729a154a8"]
  }
}

    Create AuthenticatorMethodWebauthn Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AuthenticatorMethodWebauthn(name: string, args: AuthenticatorMethodWebauthnArgs, opts?: CustomResourceOptions);
    @overload
def AuthenticatorMethodWebauthn(resource_name: str,
                                args: AuthenticatorMethodWebauthnArgs,
                                opts: Optional[ResourceOptions] = None)

@overload
def AuthenticatorMethodWebauthn(resource_name: str,
                                opts: Optional[ResourceOptions] = None,
                                authenticator_id: Optional[str] = None,
                                fips_compliant: Optional[bool] = None,
                                attachment: Optional[str] = None,
                                allow_syncable_passkeys: Optional[bool] = None,
                                cert_based_attestation_validation: Optional[bool] = None,
                                enable_autofill_ui: Optional[bool] = None,
                                aaguid_groups: Optional[Sequence[AuthenticatorMethodWebauthnAaguidGroupArgs]] = None,
                                hardware_protected: Optional[bool] = None,
                                resident_key_requirement: Optional[str] = None,
                                rp_id: Optional[AuthenticatorMethodWebauthnRpIdArgs] = None,
                                show_sign_in_with_a_passkey_button: Optional[bool] = None,
                                user_verification: Optional[str] = None,
                                user_verification_for_verify: Optional[str] = None)
    func NewAuthenticatorMethodWebauthn(ctx *Context, name string, args AuthenticatorMethodWebauthnArgs, opts ...ResourceOption) (*AuthenticatorMethodWebauthn, error)
    public AuthenticatorMethodWebauthn(string name, AuthenticatorMethodWebauthnArgs args, CustomResourceOptions? opts = null)
    public AuthenticatorMethodWebauthn(String name, AuthenticatorMethodWebauthnArgs args)
public AuthenticatorMethodWebauthn(String name, AuthenticatorMethodWebauthnArgs args, CustomResourceOptions options)

    type: okta:AuthenticatorMethodWebauthn
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "okta_authenticator_method_webauthn" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args AuthenticatorMethodWebauthnArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AuthenticatorMethodWebauthnArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AuthenticatorMethodWebauthnArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AuthenticatorMethodWebauthnArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AuthenticatorMethodWebauthnArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var authenticatorMethodWebauthnResource = new Okta.AuthenticatorMethodWebauthn("authenticatorMethodWebauthnResource", new()
{
    AuthenticatorId = "string",
    FipsCompliant = false,
    Attachment = "string",
    AllowSyncablePasskeys = false,
    CertBasedAttestationValidation = false,
    EnableAutofillUi = false,
    AaguidGroups = new[]
    {
        new Okta.Inputs.AuthenticatorMethodWebauthnAaguidGroupArgs
        {
            Aaguids = new[]
            {
                "string",
            },
            Name = "string",
        },
    },
    HardwareProtected = false,
    ResidentKeyRequirement = "string",
    RpId = new Okta.Inputs.AuthenticatorMethodWebauthnRpIdArgs
    {
        Domain = new Okta.Inputs.AuthenticatorMethodWebauthnRpIdDomainArgs
        {
            Name = "string",
            ValidationStatus = "string",
        },
        Enabled = false,
    },
    ShowSignInWithAPasskeyButton = false,
    UserVerification = "string",
    UserVerificationForVerify = "string",
});

    example, err := okta.NewAuthenticatorMethodWebauthn(ctx, "authenticatorMethodWebauthnResource", &okta.AuthenticatorMethodWebauthnArgs{
	AuthenticatorId:                pulumi.String("string"),
	FipsCompliant:                  pulumi.Bool(false),
	Attachment:                     pulumi.String("string"),
	AllowSyncablePasskeys:          pulumi.Bool(false),
	CertBasedAttestationValidation: pulumi.Bool(false),
	EnableAutofillUi:               pulumi.Bool(false),
	AaguidGroups: okta.AuthenticatorMethodWebauthnAaguidGroupArray{
		&okta.AuthenticatorMethodWebauthnAaguidGroupArgs{
			Aaguids: pulumi.StringArray{
				pulumi.String("string"),
			},
			Name: pulumi.String("string"),
		},
	},
	HardwareProtected:      pulumi.Bool(false),
	ResidentKeyRequirement: pulumi.String("string"),
	RpId: &okta.AuthenticatorMethodWebauthnRpIdArgs{
		Domain: &okta.AuthenticatorMethodWebauthnRpIdDomainArgs{
			Name:             pulumi.String("string"),
			ValidationStatus: pulumi.String("string"),
		},
		Enabled: pulumi.Bool(false),
	},
	ShowSignInWithAPasskeyButton: pulumi.Bool(false),
	UserVerification:             pulumi.String("string"),
	UserVerificationForVerify:    pulumi.String("string"),
})

    resource "okta_authenticator_method_webauthn" "authenticatorMethodWebauthnResource" {
  lifecycle {
    create_before_destroy = true
  }
  authenticator_id                  = "string"
  fips_compliant                    = false
  attachment                        = "string"
  allow_syncable_passkeys           = false
  cert_based_attestation_validation = false
  enable_autofill_ui                = false
  aaguid_groups {
    aaguids = ["string"]
    name    = "string"
  }
  hardware_protected       = false
  resident_key_requirement = "string"
  rp_id = {
    domain = {
      name              = "string"
      validation_status = "string"
    }
    enabled = false
  }
  show_sign_in_with_a_passkey_button = false
  user_verification                  = "string"
  user_verification_for_verify       = "string"
}

    var authenticatorMethodWebauthnResource = new AuthenticatorMethodWebauthn("authenticatorMethodWebauthnResource", AuthenticatorMethodWebauthnArgs.builder()
    .authenticatorId("string")
    .fipsCompliant(false)
    .attachment("string")
    .allowSyncablePasskeys(false)
    .certBasedAttestationValidation(false)
    .enableAutofillUi(false)
    .aaguidGroups(AuthenticatorMethodWebauthnAaguidGroupArgs.builder()
        .aaguids("string")
        .name("string")
        .build())
    .hardwareProtected(false)
    .residentKeyRequirement("string")
    .rpId(AuthenticatorMethodWebauthnRpIdArgs.builder()
        .domain(AuthenticatorMethodWebauthnRpIdDomainArgs.builder()
            .name("string")
            .validationStatus("string")
            .build())
        .enabled(false)
        .build())
    .showSignInWithAPasskeyButton(false)
    .userVerification("string")
    .userVerificationForVerify("string")
    .build());

    authenticator_method_webauthn_resource = okta.AuthenticatorMethodWebauthn("authenticatorMethodWebauthnResource",
    authenticator_id="string",
    fips_compliant=False,
    attachment="string",
    allow_syncable_passkeys=False,
    cert_based_attestation_validation=False,
    enable_autofill_ui=False,
    aaguid_groups=[{
        "aaguids": ["string"],
        "name": "string",
    }],
    hardware_protected=False,
    resident_key_requirement="string",
    rp_id={
        "domain": {
            "name": "string",
            "validation_status": "string",
        },
        "enabled": False,
    },
    show_sign_in_with_a_passkey_button=False,
    user_verification="string",
    user_verification_for_verify="string")

    const authenticatorMethodWebauthnResource = new okta.AuthenticatorMethodWebauthn("authenticatorMethodWebauthnResource", {
    authenticatorId: "string",
    fipsCompliant: false,
    attachment: "string",
    allowSyncablePasskeys: false,
    certBasedAttestationValidation: false,
    enableAutofillUi: false,
    aaguidGroups: [{
        aaguids: ["string"],
        name: "string",
    }],
    hardwareProtected: false,
    residentKeyRequirement: "string",
    rpId: {
        domain: {
            name: "string",
            validationStatus: "string",
        },
        enabled: false,
    },
    showSignInWithAPasskeyButton: false,
    userVerification: "string",
    userVerificationForVerify: "string",
});

    type: okta:AuthenticatorMethodWebauthn
properties:
    aaguidGroups:
        - aaguids:
            - string
          name: string
    allowSyncablePasskeys: false
    attachment: string
    authenticatorId: string
    certBasedAttestationValidation: false
    enableAutofillUi: false
    fipsCompliant: false
    hardwareProtected: false
    residentKeyRequirement: string
    rpId:
        domain:
            name: string
            validationStatus: string
        enabled: false
    showSignInWithAPasskeyButton: false
    userVerification: string
    userVerificationForVerify: string

    AuthenticatorMethodWebauthn Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AuthenticatorMethodWebauthn resource accepts the following input properties:

    AuthenticatorId string
    The ID of the WebAuthn authenticator.
    AaguidGroups List<AuthenticatorMethodWebauthnAaguidGroup>
    List of AAGUID group configurations.
    AllowSyncablePasskeys bool
    Whether syncable passkeys are allowed.
    Attachment string
    Method attachment setting.
    CertBasedAttestationValidation bool
    Whether certificate-based attestation validation is enabled.
    EnableAutofillUi bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    FipsCompliant bool
    Whether the authenticator must be FIPS compliant.
    HardwareProtected bool
    Whether the authenticator must store the private key on hardware.
    ResidentKeyRequirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    RpId AuthenticatorMethodWebauthnRpId
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    ShowSignInWithAPasskeyButton bool
    Whether to show the "Sign in with a Passkey" button.
    UserVerification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    UserVerificationForVerify string
    User verification setting for authentication (verification).
    AuthenticatorId string
    The ID of the WebAuthn authenticator.
    AaguidGroups []AuthenticatorMethodWebauthnAaguidGroupArgs
    List of AAGUID group configurations.
    AllowSyncablePasskeys bool
    Whether syncable passkeys are allowed.
    Attachment string
    Method attachment setting.
    CertBasedAttestationValidation bool
    Whether certificate-based attestation validation is enabled.
    EnableAutofillUi bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    FipsCompliant bool
    Whether the authenticator must be FIPS compliant.
    HardwareProtected bool
    Whether the authenticator must store the private key on hardware.
    ResidentKeyRequirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    RpId AuthenticatorMethodWebauthnRpIdArgs
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    ShowSignInWithAPasskeyButton bool
    Whether to show the "Sign in with a Passkey" button.
    UserVerification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    UserVerificationForVerify string
    User verification setting for authentication (verification).
    authenticator_id string
    The ID of the WebAuthn authenticator.
    aaguid_groups list(object)
    List of AAGUID group configurations.
    allow_syncable_passkeys bool
    Whether syncable passkeys are allowed.
    attachment string
    Method attachment setting.
    cert_based_attestation_validation bool
    Whether certificate-based attestation validation is enabled.
    enable_autofill_ui bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fips_compliant bool
    Whether the authenticator must be FIPS compliant.
    hardware_protected bool
    Whether the authenticator must store the private key on hardware.
    resident_key_requirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rp_id object
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    show_sign_in_with_a_passkey_button bool
    Whether to show the "Sign in with a Passkey" button.
    user_verification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    user_verification_for_verify string
    User verification setting for authentication (verification).
    authenticatorId String
    The ID of the WebAuthn authenticator.
    aaguidGroups List<AuthenticatorMethodWebauthnAaguidGroup>
    List of AAGUID group configurations.
    allowSyncablePasskeys Boolean
    Whether syncable passkeys are allowed.
    attachment String
    Method attachment setting.
    certBasedAttestationValidation Boolean
    Whether certificate-based attestation validation is enabled.
    enableAutofillUi Boolean
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fipsCompliant Boolean
    Whether the authenticator must be FIPS compliant.
    hardwareProtected Boolean
    Whether the authenticator must store the private key on hardware.
    residentKeyRequirement String
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rpId AuthenticatorMethodWebauthnRpId
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    showSignInWithAPasskeyButton Boolean
    Whether to show the "Sign in with a Passkey" button.
    userVerification String
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    userVerificationForVerify String
    User verification setting for authentication (verification).
    authenticatorId string
    The ID of the WebAuthn authenticator.
    aaguidGroups AuthenticatorMethodWebauthnAaguidGroup[]
    List of AAGUID group configurations.
    allowSyncablePasskeys boolean
    Whether syncable passkeys are allowed.
    attachment string
    Method attachment setting.
    certBasedAttestationValidation boolean
    Whether certificate-based attestation validation is enabled.
    enableAutofillUi boolean
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fipsCompliant boolean
    Whether the authenticator must be FIPS compliant.
    hardwareProtected boolean
    Whether the authenticator must store the private key on hardware.
    residentKeyRequirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rpId AuthenticatorMethodWebauthnRpId
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    showSignInWithAPasskeyButton boolean
    Whether to show the "Sign in with a Passkey" button.
    userVerification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    userVerificationForVerify string
    User verification setting for authentication (verification).
    authenticator_id str
    The ID of the WebAuthn authenticator.
    aaguid_groups Sequence[AuthenticatorMethodWebauthnAaguidGroupArgs]
    List of AAGUID group configurations.
    allow_syncable_passkeys bool
    Whether syncable passkeys are allowed.
    attachment str
    Method attachment setting.
    cert_based_attestation_validation bool
    Whether certificate-based attestation validation is enabled.
    enable_autofill_ui bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fips_compliant bool
    Whether the authenticator must be FIPS compliant.
    hardware_protected bool
    Whether the authenticator must store the private key on hardware.
    resident_key_requirement str
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rp_id AuthenticatorMethodWebauthnRpIdArgs
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    show_sign_in_with_a_passkey_button bool
    Whether to show the "Sign in with a Passkey" button.
    user_verification str
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    user_verification_for_verify str
    User verification setting for authentication (verification).
    authenticatorId String
    The ID of the WebAuthn authenticator.
    aaguidGroups List<Property Map>
    List of AAGUID group configurations.
    allowSyncablePasskeys Boolean
    Whether syncable passkeys are allowed.
    attachment String
    Method attachment setting.
    certBasedAttestationValidation Boolean
    Whether certificate-based attestation validation is enabled.
    enableAutofillUi Boolean
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fipsCompliant Boolean
    Whether the authenticator must be FIPS compliant.
    hardwareProtected Boolean
    Whether the authenticator must store the private key on hardware.
    residentKeyRequirement String
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rpId Property Map
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    showSignInWithAPasskeyButton Boolean
    Whether to show the "Sign in with a Passkey" button.
    userVerification String
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    userVerificationForVerify String
    User verification setting for authentication (verification).

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AuthenticatorMethodWebauthn resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    Id string
    The provider-assigned unique ID for this managed resource.
    Status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    id string
    The provider-assigned unique ID for this managed resource.
    status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    id String
    The provider-assigned unique ID for this managed resource.
    status String
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    id string
    The provider-assigned unique ID for this managed resource.
    status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    id str
    The provider-assigned unique ID for this managed resource.
    status str
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    id String
    The provider-assigned unique ID for this managed resource.
    status String
    The status of the WebAuthn method (ACTIVE or INACTIVE).

    Look up Existing AuthenticatorMethodWebauthn Resource

    Get an existing AuthenticatorMethodWebauthn resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AuthenticatorMethodWebauthnState, opts?: CustomResourceOptions): AuthenticatorMethodWebauthn
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        aaguid_groups: Optional[Sequence[AuthenticatorMethodWebauthnAaguidGroupArgs]] = None,
        allow_syncable_passkeys: Optional[bool] = None,
        attachment: Optional[str] = None,
        authenticator_id: Optional[str] = None,
        cert_based_attestation_validation: Optional[bool] = None,
        enable_autofill_ui: Optional[bool] = None,
        fips_compliant: Optional[bool] = None,
        hardware_protected: Optional[bool] = None,
        resident_key_requirement: Optional[str] = None,
        rp_id: Optional[AuthenticatorMethodWebauthnRpIdArgs] = None,
        show_sign_in_with_a_passkey_button: Optional[bool] = None,
        status: Optional[str] = None,
        user_verification: Optional[str] = None,
        user_verification_for_verify: Optional[str] = None) -> AuthenticatorMethodWebauthn
    func GetAuthenticatorMethodWebauthn(ctx *Context, name string, id IDInput, state *AuthenticatorMethodWebauthnState, opts ...ResourceOption) (*AuthenticatorMethodWebauthn, error)
    public static AuthenticatorMethodWebauthn Get(string name, Input<string> id, AuthenticatorMethodWebauthnState? state, CustomResourceOptions? opts = null)
    public static AuthenticatorMethodWebauthn get(String name, Output<String> id, AuthenticatorMethodWebauthnState state, CustomResourceOptions options)
    resources:  _:    type: okta:AuthenticatorMethodWebauthn    get:      id: ${id}
    import {
  to = okta_authenticator_method_webauthn.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AaguidGroups List<AuthenticatorMethodWebauthnAaguidGroup>
    List of AAGUID group configurations.
    AllowSyncablePasskeys bool
    Whether syncable passkeys are allowed.
    Attachment string
    Method attachment setting.
    AuthenticatorId string
    The ID of the WebAuthn authenticator.
    CertBasedAttestationValidation bool
    Whether certificate-based attestation validation is enabled.
    EnableAutofillUi bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    FipsCompliant bool
    Whether the authenticator must be FIPS compliant.
    HardwareProtected bool
    Whether the authenticator must store the private key on hardware.
    ResidentKeyRequirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    RpId AuthenticatorMethodWebauthnRpId
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    ShowSignInWithAPasskeyButton bool
    Whether to show the "Sign in with a Passkey" button.
    Status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    UserVerification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    UserVerificationForVerify string
    User verification setting for authentication (verification).
    AaguidGroups []AuthenticatorMethodWebauthnAaguidGroupArgs
    List of AAGUID group configurations.
    AllowSyncablePasskeys bool
    Whether syncable passkeys are allowed.
    Attachment string
    Method attachment setting.
    AuthenticatorId string
    The ID of the WebAuthn authenticator.
    CertBasedAttestationValidation bool
    Whether certificate-based attestation validation is enabled.
    EnableAutofillUi bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    FipsCompliant bool
    Whether the authenticator must be FIPS compliant.
    HardwareProtected bool
    Whether the authenticator must store the private key on hardware.
    ResidentKeyRequirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    RpId AuthenticatorMethodWebauthnRpIdArgs
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    ShowSignInWithAPasskeyButton bool
    Whether to show the "Sign in with a Passkey" button.
    Status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    UserVerification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    UserVerificationForVerify string
    User verification setting for authentication (verification).
    aaguid_groups list(object)
    List of AAGUID group configurations.
    allow_syncable_passkeys bool
    Whether syncable passkeys are allowed.
    attachment string
    Method attachment setting.
    authenticator_id string
    The ID of the WebAuthn authenticator.
    cert_based_attestation_validation bool
    Whether certificate-based attestation validation is enabled.
    enable_autofill_ui bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fips_compliant bool
    Whether the authenticator must be FIPS compliant.
    hardware_protected bool
    Whether the authenticator must store the private key on hardware.
    resident_key_requirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rp_id object
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    show_sign_in_with_a_passkey_button bool
    Whether to show the "Sign in with a Passkey" button.
    status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    user_verification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    user_verification_for_verify string
    User verification setting for authentication (verification).
    aaguidGroups List<AuthenticatorMethodWebauthnAaguidGroup>
    List of AAGUID group configurations.
    allowSyncablePasskeys Boolean
    Whether syncable passkeys are allowed.
    attachment String
    Method attachment setting.
    authenticatorId String
    The ID of the WebAuthn authenticator.
    certBasedAttestationValidation Boolean
    Whether certificate-based attestation validation is enabled.
    enableAutofillUi Boolean
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fipsCompliant Boolean
    Whether the authenticator must be FIPS compliant.
    hardwareProtected Boolean
    Whether the authenticator must store the private key on hardware.
    residentKeyRequirement String
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rpId AuthenticatorMethodWebauthnRpId
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    showSignInWithAPasskeyButton Boolean
    Whether to show the "Sign in with a Passkey" button.
    status String
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    userVerification String
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    userVerificationForVerify String
    User verification setting for authentication (verification).
    aaguidGroups AuthenticatorMethodWebauthnAaguidGroup[]
    List of AAGUID group configurations.
    allowSyncablePasskeys boolean
    Whether syncable passkeys are allowed.
    attachment string
    Method attachment setting.
    authenticatorId string
    The ID of the WebAuthn authenticator.
    certBasedAttestationValidation boolean
    Whether certificate-based attestation validation is enabled.
    enableAutofillUi boolean
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fipsCompliant boolean
    Whether the authenticator must be FIPS compliant.
    hardwareProtected boolean
    Whether the authenticator must store the private key on hardware.
    residentKeyRequirement string
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rpId AuthenticatorMethodWebauthnRpId
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    showSignInWithAPasskeyButton boolean
    Whether to show the "Sign in with a Passkey" button.
    status string
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    userVerification string
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    userVerificationForVerify string
    User verification setting for authentication (verification).
    aaguid_groups Sequence[AuthenticatorMethodWebauthnAaguidGroupArgs]
    List of AAGUID group configurations.
    allow_syncable_passkeys bool
    Whether syncable passkeys are allowed.
    attachment str
    Method attachment setting.
    authenticator_id str
    The ID of the WebAuthn authenticator.
    cert_based_attestation_validation bool
    Whether certificate-based attestation validation is enabled.
    enable_autofill_ui bool
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fips_compliant bool
    Whether the authenticator must be FIPS compliant.
    hardware_protected bool
    Whether the authenticator must store the private key on hardware.
    resident_key_requirement str
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rp_id AuthenticatorMethodWebauthnRpIdArgs
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    show_sign_in_with_a_passkey_button bool
    Whether to show the "Sign in with a Passkey" button.
    status str
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    user_verification str
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    user_verification_for_verify str
    User verification setting for authentication (verification).
    aaguidGroups List<Property Map>
    List of AAGUID group configurations.
    allowSyncablePasskeys Boolean
    Whether syncable passkeys are allowed.
    attachment String
    Method attachment setting.
    authenticatorId String
    The ID of the WebAuthn authenticator.
    certBasedAttestationValidation Boolean
    Whether certificate-based attestation validation is enabled.
    enableAutofillUi Boolean
    Enables the passkeys autofill UI for WebAuthn discoverable credentials.
    fipsCompliant Boolean
    Whether the authenticator must be FIPS compliant.
    hardwareProtected Boolean
    Whether the authenticator must store the private key on hardware.
    residentKeyRequirement String
    Resident key requirement. Values: REQUIRED, DISCOURAGED, PREFERRED.
    rpId Property Map
    The Relying Party (RP) ID configuration for WebAuthn. Contains:
    showSignInWithAPasskeyButton Boolean
    Whether to show the "Sign in with a Passkey" button.
    status String
    The status of the WebAuthn method (ACTIVE or INACTIVE).
    userVerification String
    User verification setting for enrollment. Values: DISCOURAGED, PREFERRED, REQUIRED.
    userVerificationForVerify String
    User verification setting for authentication (verification).

    Supporting Types

    AuthenticatorMethodWebauthnAaguidGroup, AuthenticatorMethodWebauthnAaguidGroupArgs

    Aaguids List<string>
    A list of FIDO2 AAGUIDs in this group.
    Name string
    A name to identify the group of FIDO2 AAGUIDs.
    Aaguids []string
    A list of FIDO2 AAGUIDs in this group.
    Name string
    A name to identify the group of FIDO2 AAGUIDs.
    aaguids list(string)
    A list of FIDO2 AAGUIDs in this group.
    name string
    A name to identify the group of FIDO2 AAGUIDs.
    aaguids List<String>
    A list of FIDO2 AAGUIDs in this group.
    name String
    A name to identify the group of FIDO2 AAGUIDs.
    aaguids string[]
    A list of FIDO2 AAGUIDs in this group.
    name string
    A name to identify the group of FIDO2 AAGUIDs.
    aaguids Sequence[str]
    A list of FIDO2 AAGUIDs in this group.
    name str
    A name to identify the group of FIDO2 AAGUIDs.
    aaguids List<String>
    A list of FIDO2 AAGUIDs in this group.
    name String
    A name to identify the group of FIDO2 AAGUIDs.

    AuthenticatorMethodWebauthnRpId, AuthenticatorMethodWebauthnRpIdArgs

    Domain AuthenticatorMethodWebauthnRpIdDomain
    The RP domain configuration. Contains:
    Enabled bool
    Whether the RP ID is active and used for WebAuthn operations.
    Domain AuthenticatorMethodWebauthnRpIdDomain
    The RP domain configuration. Contains:
    Enabled bool
    Whether the RP ID is active and used for WebAuthn operations.
    domain object
    The RP domain configuration. Contains:
    enabled bool
    Whether the RP ID is active and used for WebAuthn operations.
    domain AuthenticatorMethodWebauthnRpIdDomain
    The RP domain configuration. Contains:
    enabled Boolean
    Whether the RP ID is active and used for WebAuthn operations.
    domain AuthenticatorMethodWebauthnRpIdDomain
    The RP domain configuration. Contains:
    enabled boolean
    Whether the RP ID is active and used for WebAuthn operations.
    domain AuthenticatorMethodWebauthnRpIdDomain
    The RP domain configuration. Contains:
    enabled bool
    Whether the RP ID is active and used for WebAuthn operations.
    domain Property Map
    The RP domain configuration. Contains:
    enabled Boolean
    Whether the RP ID is active and used for WebAuthn operations.

    AuthenticatorMethodWebauthnRpIdDomain, AuthenticatorMethodWebauthnRpIdDomainArgs

    Name string
    The RP ID domain value used for WebAuthn operations.
    ValidationStatus string
    The validation status of the domain.
    Name string
    The RP ID domain value used for WebAuthn operations.
    ValidationStatus string
    The validation status of the domain.
    name string
    The RP ID domain value used for WebAuthn operations.
    validation_status string
    The validation status of the domain.
    name String
    The RP ID domain value used for WebAuthn operations.
    validationStatus String
    The validation status of the domain.
    name string
    The RP ID domain value used for WebAuthn operations.
    validationStatus string
    The validation status of the domain.
    name str
    The RP ID domain value used for WebAuthn operations.
    validation_status str
    The validation status of the domain.
    name String
    The RP ID domain value used for WebAuthn operations.
    validationStatus String
    The validation status of the domain.

    Import

    The WebAuthn method can be imported using the authenticator ID:

    $ pulumi import okta:index/authenticatorMethodWebauthn:AuthenticatorMethodWebauthn example aut1234567890

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Okta pulumi/pulumi-okta
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the okta Terraform Provider.
    okta logo
    Viewing docs for Okta v6.9.0
    published on Wednesday, Jul 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-okta

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial