WebAuthn Level 3 is a Recommendation, which means the passkey surface stops moving

A Recommendation is not a new feature. It is a promise that the text you build against will not shift under you, and for an API that guards sign-in that promise is the whole value. The Web Authentication Working Group published Level 3 of the credential API on August 25, and stated plainly that new work moves to Level 4.

What is inside the frozen text

Level 3 defines the API for creating and using public key credentials, which is the machinery behind passkeys. Alongside the registration and authentication ceremonies it carries a method for asking the client what it can do, getClientCapabilities, and two helpers that turn server-sent JSON into the option objects the ceremonies expect, parseCreationOptionsFromJSON and parseRequestOptionsFromJSON.

It also defines the signal methods, signalUnknownCredential, signalAllAcceptedCredentials and signalCurrentUserDetails, which let a site tell the credential store that something on the server side has changed, and the rules for validating related origins.

What the milestone does not tell you

A Recommendation says the specification is stable. It says nothing about which browsers implement which part of it, and that is the question a site actually has to answer before it removes a password field. The status line and the support line are two different things, and the second one has to be checked against the browsers, not against the standard.

The Working Group's own note frames the release the same way: Level 3 succeeds Level 2, and the next batch of features has already been moved out of it.