---
title: WebAuthn verification settings
description: Configure the FIDO Metadata Service endpoint and revocation settings that Advanced Identity Cloud uses to verify WebAuthn authenticator attestations
component: pingoneaic
page_id: pingoneaic:authentication:authentication-methods-webauthn-verification
canonical_url: https://docs.pingidentity.com/pingoneaic/authentication/authentication-methods-webauthn-verification.html
llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Authentication", "Multi-factor Authentication (MFA)", "WebAuthn", "FIDO", "passkey", "attestation", "metadata"]
section_ids:
  configure-webauthn-verification: Configure WebAuthn verification settings
---

# WebAuthn verification settings

WebAuthn verification settings control how Advanced Identity Cloud obtains and validates metadata from the [FIDO Metadata Service (MDS)](https://fidoalliance.org/metadata/).

When an end user registers a WebAuthn authenticator, Advanced Identity Cloud can verify the authenticator's attestation, which is a signed statement from the device manufacturer confirming the authenticator's model and security properties. The FIDO MDS provides the metadata and root certificates needed to perform this verification.

These settings are available by default. You only need to configure them if you want to use a custom metadata source, such as a local or non-default metadata blob location, or if you want to enable revocation checking during attestation validation.

Learn more about how to configure Advanced Identity Cloud to store WebAuthn device profiles in [WebAuthn storage & encryption settings](authentication-methods-webauthn-encryption.html).

## Configure WebAuthn verification settings

1. In the Advanced Identity Cloud admin console, go to [icon: verified_user, set=material, size=inline] Authentication > Authentication Methods.

2. Click WebAuthn Verification.

3. If WebAuthn verification is not already enabled, click Enable WebAuthn Verification to create it with default settings before configuring it.

4. Configure the following settings:

   * Metadata service URIs

     The list of locations from which to download the [metadata blob](https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html#metadata-blob).

     Advanced Identity Cloud verifies the blob signature against secrets mapped to the `am.authentication.nodes.webauthn.fidometadataservice.rootcertificate` secret label.

   * Enforce revocation check

     This setting specifies whether Advanced Identity Cloud must check revocation entries from certificates.

     The setting is disabled by default, so Advanced Identity Cloud doesn't check presented certificates for revocation.

     If you enable this setting, Advanced Identity Cloud must be able to verify any attestation certificate's trust chain with a CRL or OCSP entry during processing.

     |   |                                                                                            |
     | - | ------------------------------------------------------------------------------------------ |
     |   | Certificates downloaded from the FIDO Metadata Service might not have a CRL or OCSP entry. |

5. Click Save.