WebAuthn
WebAuthn is the W3C Web Authentication API and associated protocol that lets a web service register public-key credentials and verify authentication responses from an authenticator.
What the browser helps prove
The web service is called the relying party. During registration, it associates a public-key credential with an account. During authentication, it supplies a challenge and verifies the returned response using the registered public key and the protocol’s other required checks.
The browser, authenticator, and server each have a role. WebAuthn provides service-bound authentication; NIST describes its domain binding as a mechanism for phishing resistance. The server still has to validate the response correctly. Seeing a passkey prompt does not tell you whether the server performed those checks.
A passkey is a credential used through this interface. FIDO2 is the wider set of standards. WebAuthn is the part a web application integrates.
The server has work to do too
The server must check more than the signature. Among the W3C requirements are verifying the expected challenge, origin, and relying-party ID hash. A maintained library can handle the protocol checks, but the application still needs the right configuration and account mapping.
For an implementation review, test rejection as well as successful sign-in: an unexpected challenge or origin must not be accepted. These are examples, not a complete WebAuthn test plan.
After authentication, the application creates or updates its own session. Review that session separately; WebAuthn does not specify every permission the signed-in account should have.