---
source_url: "https://github.com/w3c/webauthn/issues/991"
title: "Indicate resident key credential \"preferred\" during registration and find out what the authenticator offered · Issue #991 · w3c/webauthn · GitHub"
mirrored_at: 2026-08-04T01:32:27.058Z
host: github.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/github.com/w3c/webauthn/issues/991"
---

> **Original source:** https://github.com/w3c/webauthn/issues/991

I'd like to revisit the scenario I was trying to achieve in the (now closed) issue [#987](https://github.com/w3c/webauthn/issues/987)

Why can't the "requireResidentKey" authenticator selection criteria be a value like "preferred", "required" or "never" instead of a boolean true/false? In addition the registration response could indicate residentKey true/false as a flag similar to the userPresent and userVerified flags, or in an extension.

That way, without knowing ahead of time if an authenticator is capable of resident key (even a portable security key), the relying party could request it with fallback to derived credential (without a hard error), then notify the user of what actually happened and therefore what scenarios their key might be used for (replacement for regular username/password authentication, or only 2nd-factor scenarios)?