Pre-rewrite scenario. This walkthrough was written against an earlier draft of draft-hardt-aauth-bootstrap. As of -01 the document is informational AP-side enrollment guidance; the PS /bootstrap endpoint, bootstrap_token, and aa-bootstrap+jwthave been removed. PS-binding now happens lazily on the agent's first interaction with the PS. See the bootstrap overview for current framing.
Web App Bootstrap
Agent runs in the browser; agent provider runs separately. The PS authenticates the user and issues a bootstrap_token; the agent provider's webauthn_endpoint provides the WebAuthn challenge; the agent calls navigator.credentials.create() and POSTs the attestation to the agent provider's bootstrap_endpoint, which creates the binding and issues the agent token. The agent then announces its new identity back to the PS.
Agent generates an ephemeral Ed25519 signing key pair using the Web Crypto API.
This key will be used to sign the PS /bootstrap request under the hwk scheme.
The key's thumbprint will appear in the bootstrap_token's cnf.jwk claim.
In the web app profile no durable enclave key exists — only this ephemeral key.
Step 1: Generate ephemeral signing key
No headers