In WebAuthn, the relying party is the service or website that depends on an authenticator to prove a user’s identity. It creates the login challenge, receives the assertion from the browser, and verifies that the response belongs to the expected account and origin. In practice, the relying party is usually the application backend, identity platform, or login service.
This role matters because WebAuthn security depends on correct binding between the credential and the relying party ID. The server must check the challenge, origin, credential ID, signature, and other ceremony details. If those checks are weak, an attacker may confuse login state, abuse a redirected flow, or reuse a valid-looking assertion in the wrong context. Strong relying party validation is one of the main defenses that keeps passkeys phishing-resistant instead of just password-like.