ReadonlyalgorithmSignature algorithm of recoveryKey (e.g. ES256, ED25519).
Optional ReadonlykindOptional ReadonlylabelUser-visible name; without it credentials are told apart only by issuance date.
ReadonlylookupHex-encoded public handle used to look up (and revoke) this credential.
ReadonlyrecoveryHex-encoded public key that will sign the recovery challenge.
A key held outside HALO (a passkey) to register as a recovery credential. The WebAuthn ceremony stays at the call site; only the credential write moves here.
labelandkinddescribe the external key, so they are meaningful only alongside it.