Fortect Key -

Absolutely. The Management Console lets you enable multi‑factor policies that require both a TOTP and the hardware key for high‑risk actions.

// 4. Send the signed assertion back to the server for verification const data = id: assertion.id, rawId: btoa(String.fromCharCode(...new Uint8Array(assertion.rawId))), response: authenticatorData: btoa(String.fromCharCode(...new Uint8Array(assertion.response.authenticatorData))), clientDataJSON: btoa(String.fromCharCode(...new Uint8Array(assertion.response.clientDataJSON))), signature: btoa(String.fromCharCode(...new Uint8Array(assertion.response.signature))), userHandle: assertion.response.userHandle ? btoa(String.fromCharCode(...new Uint8Array(assertion.response.userHandle))) : null , type: assertion.type ; fortect key

// 2. Convert to Uint8Array objects const publicKey = challenge: Uint8Array.from(atob(challenge), c => c.charCodeAt(0)), allowCredentials: allowCredentials.map(cred => ( type: 'public-key', id: Uint8Array.from(atob(cred.id), c => c.charCodeAt(0)), transports: cred.transports )) ; Absolutely

await fetch('/webauthn/verify-login', method: 'POST', headers: 'Content-Type': 'application/json', body: JSON.stringify(data) ); Send the signed assertion back to the server

<script> // 1. Get the challenge from your server (Base64URL encoded) async function startLogin() const resp = await fetch('/webauthn/login-challenge'); const challenge, allowCredentials = await resp.json();