Pre-rewrite scenario. This walkthrough was written against an earlier draft of draft-hardt-aauth-bootstrap. As of -01 the document is informational AP-side enrollment guidance; the PS /bootstrap endpoint, bootstrap_token, and aa-bootstrap+jwthave been removed. PS-binding now happens lazily on the agent's first interaction with the PS. See the bootstrap overview for current framing.
Token Renewal — Web App (WebAuthn)
After an agent token expires, the browser agent renews without re-involving the PS. The agent fetches a fresh challenge from the agent provider's webauthn_endpoint, invokes navigator.credentials.get() to produce a WebAuthn assertion (signed by the device credential enrolled at bootstrap), generates a new ephemeral signing key, and POSTs to refresh_endpoint. The agent provider verifies the assertion, looks up the binding by credential rawId, and issues a fresh agent token.
Agent fetches a single-use challenge from the agent provider's webauthn_endpoint.
type=get signals this is a renewal (assertion), not a registration (create).
The request is unsigned — the agent MUST NOT include user identifiers.
Agent provider stores the challenge in a single-use, time-limited registry (expires ~5 minutes).
The challenge response contains ONLY the challenge — no user-identifying information.
Step 1: Fetch WebAuthn assertion challenge
No headers