# Devch Passkey Login

Devch Passkey Login adds passwordless passkey authentication (WebAuthn/FIDO2) to WordPress 6.3+ and PHP 7.4+, with first-class multisite support.

## Features

- Passkey registration and authentication ceremonies
- Single-site and multisite network support
- Per-site credential/challenge storage
- Network-wide security audit log
- REST API (`/wp-json/devch-passkey-login/v1`)
- User profile passkey management UI
- Password login remains available as a fallback

## Release

- Current version: `1.0.0`
- First public release date: `2026-03-09`

## Development

### 1. Install dependencies

```bash
composer install
```

### 2. Run linting

```bash
# Syntax-only PHP lint
composer lint:php

# WordPress coding standards + PHP compatibility checks
composer lint:phpcs

# Run both
composer lint
```

### 3. PHPCS config

- PHPCS uses [phpcs.xml.dist](phpcs.xml.dist) in the plugin root.
- Rules included:
	- `WordPress`
	- `PHPCompatibilityWP` with `testVersion` set to `7.4-`

You can also run PHPCS directly:

```bash
phpcs --standard=phpcs.xml.dist
```

## Security Notes

- Existing password login remains available unless explicitly disabled by administrators.
- Sensitive material (private keys, raw attestation objects) is never logged.