title: WebAuthn authenticator attestation response id and rawId
body: <p>I would like to ask a question regarding <code>id</code> and <code>rawId</code>.</p>
  <p>When implementing webauthn, in the authenticator attestation response, I see that we have both <code>id</code> and <code>rawId</code> . Reading the spec (<a href="https://www.w3.org/TR/webauthn-1/#dom-publickeycredential-rawid" rel="nofollow noreferrer">https://www.w3.org/TR/webauthn-1/#dom-publickeycredential-rawid</a>) , <code>id</code> is <code>base64url(rawId)</code></p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;type&quot;: &quot;public-key&quot;,
    &quot;id&quot;: &quot;AV1--2gCLXLF9_5bGWDwZn6FP_OqAWfKY74mckatWMgN65o5OW8q2k9XVbYl8kAqPtpEoBlM0opKEjwDqYRBDIYbAl058O8ZQWS-r0M0L-9ikcu3tKuMxfFnRZ9gU6tnDH6QqzYwUg&quot;,
    &quot;rawId&quot;: &quot;AV1--2gCLXLF9_5bGWDwZn6FP_OqAWfKY74mckatWMgN65o5OW8q2k9XVbYl8kAqPtpEoBlM0opKEjwDqYRBDIYbAl058O8ZQWS-r0M0L-9ikcu3tKuMxfFnRZ9gU6tnDH6QqzYwUg&quot;,
    &quot;response&quot;: {
      ...
    }
    ...
  }
  </code></pre>
  <p>So here is my questions:</p>
  <ul>
  <li>why we need <code>id</code></li>
  <li>why in the example above, my <code>id</code> is exactly like <code>rawId</code>?
  <ul>
  <li>does it's always the same? If it does, can we get rid of <code>id</code> in the response?</li>
  </ul>
  </li>
  <li>If I save the public key <code>id</code> to the database (later use that public key <code>id</code> to create the <code>allowCredentials</code> list), which one below should I follow?
  <ol>
  <li>save <code>id</code> in the database, use <code>id</code> to create allowCredentials list</li>
  <li>save <code>base64url(rawId)</code> in the database, then use that base64 url encoded value to create <code>allowCredentials</code> list</li>
  </ol>
  </li>
  </ul>