From a8a58108df7c97fe50d94c19b269027197c82a37 Mon Sep 17 00:00:00 2001
From: Santiago Rodriguez
 <46354312+santiagorodriguez96@users.noreply.github.com>
Date: Thu, 22 Oct 2026 11:02:22 -0300
Subject: [PATCH 1/2] feat: add support for `hints` in credential options

---
 lib/webauthn/public_key_credential/options.rb              | 7 ++++---
 .../public_key_credential/creation_options_spec.rb         | 3 +++
 .../webauthn/public_key_credential/request_options_spec.rb | 3 +++
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/lib/webauthn/public_key_credential/options.rb b/lib/webauthn/public_key_credential/options.rb
index 01035534..54ded57d 100644
--- a/lib/webauthn/public_key_credential/options.rb
+++ b/lib/webauthn/public_key_credential/options.rb
@@ -9,12 +9,13 @@ class Options
 
       CHALLENGE_LENGTH = 32
 
-      attr_reader :timeout, :extensions, :relying_party
+      attr_reader :timeout, :extensions, :hints, :relying_party
 
-      def initialize(timeout: nil, extensions: nil, relying_party: WebAuthn.configuration.relying_party)
+      def initialize(timeout: nil, extensions: nil, hints: nil, relying_party: WebAuthn.configuration.relying_party)
         @relying_party = relying_party
         @timeout = timeout || default_timeout
         @extensions = default_extensions.merge(extensions || {})
+        @hints = hints
       end
 
       def challenge
@@ -24,7 +25,7 @@ def challenge
       private
 
       def attributes
-        [:challenge, :timeout, :extensions]
+        [:challenge, :timeout, :extensions, :hints]
       end
 
       def encoder
diff --git a/spec/webauthn/public_key_credential/creation_options_spec.rb b/spec/webauthn/public_key_credential/creation_options_spec.rb
index 9c5ab71b..d508947b 100644
--- a/spec/webauthn/public_key_credential/creation_options_spec.rb
+++ b/spec/webauthn/public_key_credential/creation_options_spec.rb
@@ -110,6 +110,7 @@
         user_verification: "required"
       },
       attestation: "direct",
+      hints: ["security-key", "hybrid"],
       extensions: { whatever: "whatever" },
     )
 
@@ -126,6 +127,7 @@
       authenticatorAttachment: "cross-platform", residentKey: "required", userVerification: "required"
     )
     expect(hash[:attestation]).to eq("direct")
+    expect(hash[:hints]).to eq(["security-key", "hybrid"])
     expect(hash[:extensions]).to eq(whatever: "whatever")
     expect(hash[:challenge]).to be_truthy
   end
@@ -153,6 +155,7 @@
     expect(hash).not_to have_key(:excludeCredentials)
     expect(hash).not_to have_key(:authenticatorSelection)
     expect(hash).not_to have_key(:attestation)
+    expect(hash).not_to have_key(:hints)
   end
 
   it "accepts shorthand for exclude_credentials" do
diff --git a/spec/webauthn/public_key_credential/request_options_spec.rb b/spec/webauthn/public_key_credential/request_options_spec.rb
index da03ae41..025daac2 100644
--- a/spec/webauthn/public_key_credential/request_options_spec.rb
+++ b/spec/webauthn/public_key_credential/request_options_spec.rb
@@ -54,6 +54,7 @@
       timeout: 10_000,
       allow_credentials: [{ type: "public-key", id: "credential-id", transports: ["usb", "nfc"] }],
       user_verification: "required",
+      hints: ["client-device"],
       extensions: { whatever: "whatever" },
     )
 
@@ -63,6 +64,7 @@
     expect(hash[:timeout]).to eq(10_000)
     expect(hash[:allowCredentials]).to eq([{ type: "public-key", id: "credential-id", transports: ["usb", "nfc"] }])
     expect(hash[:userVerification]).to eq("required")
+    expect(hash[:hints]).to eq(["client-device"])
     expect(hash[:extensions]).to eq(whatever: "whatever")
     expect(hash[:challenge]).to be_truthy
   end
@@ -78,6 +80,7 @@
     expect(hash[:challenge]).to be_truthy
     expect(hash).not_to have_key(:userVerification)
     expect(hash).not_to have_key(:rpId)
+    expect(hash).not_to have_key(:hints)
   end
 
   it "accepts shorthand for allow_credentials" do

From 445fe11d47e6a38a032a701ae6276851c06a8dc8 Mon Sep 17 00:00:00 2001
From: Santiago Rodriguez
 <46354312+santiagorodriguez96@users.noreply.github.com>
Date: Thu, 22 Oct 2026 12:36:55 -0300
Subject: [PATCH 2/2] docs: add CHANGELOG entry for `hints` support

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 127d5532..1b73527a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Added
 
 - Add support for crossOrigin/topOrigin verification during credential registration and authentication. [#486](https://github.com/cedarcode/webauthn-ruby/pull/486) [@nicolastemciuc]
+- Add support for the `hints` option in `WebAuthn::Credential.options_for_create` and `WebAuthn::Credential.options_for_get`. [#513](https://github.com/cedarcode/webauthn-ruby/pull/513) [@santiagorodriguez96]
 
 ## [v3.4.3](https://github.com/cedarcode/webauthn-ruby/compare/v3.4.2...v3.4.3/) - 2025-10-23