---
title: "Database and monitoring"
manual: "Passkeys Backend Authentication"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:administration-database@1.0"
source: "Administration/Database.rst"
rendered: "2026-09-20T16:07:13+00:00"
---

# Database and monitoring {#administration-database}

## Credential lifecycle {#credential-lifecycle}

Passkeys go through the following states:

1.  **Registered** -- The credential is created via the
    management API and stored in the
    `tx_nrpasskeysbe_credential` table.
1.  **Active** -- The credential is used for successful
    logins. The `last_used_at` and `sign_count` fields
    are updated on each use.
1.  **Revoked** -- An administrator revokes the credential
    via the admin API. The `revoked_at` timestamp and
    `revoked_by` admin UID are recorded. Revoked
    credentials remain in the database but are rejected
    during authentication.
1.  **Deleted** -- A user removes their own credential via
    the management API. The record is soft-deleted
    (`deleted = 1`).

## Database table {#database-table}

The extension uses a single table
`tx_nrpasskeysbe_credential` with the following schema:

| Column | Type | Description |
| --- | --- | --- |
| `uid` | int | Primary key (auto-increment) |
| `be_user` | int | FK to `be_users.uid` |
| `credential_id` | varbinary | WebAuthn credential ID (unique) |
| `public_key_cose` | blob | COSE-encoded public key |
| `sign_count` | int | Signature counter (replay detection) |
| `user_handle` | varbinary | WebAuthn user handle (SHA-256 hash) |
| `aaguid` | char(36) | Authenticator attestation GUID |
| `transports` | text | JSON array of transport hints |
| `discoverable` | tinyint(1) | Whether the browser stored the passkey as a discoverable (resident) credential: 1 yes, 0 no, NULL unknown. NULL covers passkeys registered before 1.0.0 and authenticators that report nothing. Only a discoverable passkey can appear in the browser's autofill menu. |
| `label` | varchar(128) | User-assigned label |
| `created_at` | int | Unix timestamp of creation |
| `last_used_at` | int | Unix timestamp of last use |
| `revoked_at` | int | Unix timestamp of revocation (0=active) |
| `revoked_by` | int | UID of revoking admin (0=not revoked) |
| `deleted` | tinyint | Soft delete flag |

## Monitoring {#monitoring}

The extension logs all significant events using the PSR-3
logging interface:

-   Successful passkey registrations
-   Successful passkey logins
-   Failed authentication attempts (with hashed username
    and IP)
-   Admin credential revocations
-   Admin account unlocks
-   Rate limit and lockout triggers

Configure TYPO3 logging writers to capture these events.
Example for file logging:

**Logging configuration for passkey events**

```php
$GLOBALS['TYPO3_CONF_VARS']['LOG']
    ['Netresearch']['NrPasskeysBe']
    ['writerConfiguration'] = [
        \Psr\Log\LogLevel::INFO => [
            \TYPO3\CMS\Core\Log\Writer\FileWriter::class
            => [
                'logFileInfix' => 'passkeys',
            ],
        ],
    ];
```