What is wa-passkey-connector?

takeflow-oficial/wa-passkey-connector — explained in plain English

Analysis updated 2026-05-18

★ 39TypeScriptAudience · developerComplexity · 3/5LicenseSetup · moderate

Mindmap

mindmap
  root((WA Passkey Connector))
    What it does
      Delegates passkey step
      Works with whatsmeow
      Owner browser confirms
    How it works
      postMessage protocol
      Runs on web.whatsapp.com
      Returns signed assertion
    Tech stack
      React and Tailwind
      Vite and crxjs
      Manifest V3
    Requirements
      Explicit owner consent
      Private distribution preferred
    Limits
      Cannot read WA session
      One time assertion only

mindmap root((WA Passkey Connector)) What it does Delegates passkey step Works with whatsmeow Owner browser confirms How it works postMessage protocol Runs on web.whatsapp.com Returns signed assertion Tech stack React and Tailwind Vite and crxjs Manifest V3 Requirements Explicit owner consent Private distribution preferred Limits Cannot read WA session One time assertion only

What do people build with it?

USE CASE 1

Let whatsmeow-based apps link a passkey-protected WhatsApp account without bypassing the owner's authenticator.

USE CASE 2

Add a browser extension bridge that hands one specific security step to the account owner's own browser.

USE CASE 3

Build a companion-device linking flow that respects WhatsApp's passkey security requirement.

What is it built with?

TypeScriptReactTailwind CSSViteManifest V3

How does it compare?

	takeflow-oficial/wa-passkey-connector	chaos-xxl/zelda-hyrule-ui	co-l/cache-hunter
Stars	39	39	39
Language	TypeScript	TypeScript	TypeScript
Setup difficulty	moderate	easy	moderate
Complexity	3/5	2/5	3/5
Audience	developer	developer	developer

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · moderate Time to first run · 1h+

Requires a working whatsmeow backend already handling device linking, this extension only covers the passkey confirmation step.

The Unlicense: released into the public domain, free to use, modify, distribute, or sell with no attribution required.

So what is it?

WA Passkey Connector is a browser extension that solves one specific problem for developers building on whatsmeow, an unofficial library for connecting to WhatsApp as a companion device. Normally, linking a new device to a WhatsApp account works by scanning a QR code, but accounts protected with a passkey instead require a WebAuthn signature, a kind of secure confirmation that can only come from the account owner's own browser and authenticator, such as a fingerprint reader or security key. A script running on a server has no way to produce that signature on its own. This extension bridges that one gap. Your own backend and whatsmeow client handle the entire device linking process as usual, and only the passkey step is handed off to the account owner's browser through this extension. When your web page sends a message asking for a passkey assertion, the extension opens web.whatsapp.com, asks the browser to perform the passkey confirmation with the owner's own authenticator, and sends the resulting signed assertion back to your page. It does not read anything else from the WhatsApp session and stores nothing itself, so the outcome is a genuinely new linked device rather than a copied session. To set it up, you install the dependencies, configure which website origins are allowed to talk to the extension, build it, and load it into Chrome as an unpacked extension for testing, or package it as a signed file for real distribution. Your web app then talks to it using simple browser messages: it pings the extension to check it is installed, fetches a challenge from your backend, asks the extension to run the passkey assertion, and forwards the result back to your server. It is built with React, Tailwind CSS, and Vite. The README is direct about the sensitivity of this flow: you should always get the account owner's clear consent before doing this, prefer private or enterprise distribution over a public extension store listing, and never store the one-time passkey assertion, only forward it immediately. It is released under the Unlicense, placing it fully in the public domain.

Copy-paste prompts

Prompt 1

Walk me through configuring APP_HOSTS and building this extension for my own web app.

Prompt 2

Explain the postMessage protocol this extension uses to talk to a web page.

Prompt 3

Show me how my backend should issue a passkey challenge and receive the assertion back from this extension.

Prompt 4

Explain why passkey-locked WhatsApp accounts cannot be linked with a headless QR-based approach.

Prompt 5

Summarize the consent and distribution caveats this project raises before I ship it.

Frequently asked questions