Passkeys are the name used for FIDO2 authentication flows for normal people.
WebAuthn is the JavaScript API to access the USB devices speaking U2F to the browser.
FIDO2 extends the WebAuthn API by also offering to store security tokens inside of a device's TPM, by using CTAP2 to authenticate with an external device or service, or by using good old U2F. If you're implementing it, you generally only need to deal with the WebAuthn side, the browser will take care of the rest.
You can think of Passkeys as "WebAuthn 1.1". Names like WebAuthn and U2F don't exactly attract the general consumer, so they rebranded it. The same way websites used names like "passwordless logins" when trying to describe WebAuthn+U2F, expect "passkey" seems backed by larger companies.
If you've implemented WebAuthn correctly (I doubt you actually interacted with the U2F API directly), you've also implemented passkeys.
The naming is rather confusing, mostly because a lot of websites used the wrong name for the wrong part of the process. Luckily, almost nobody acfually knows what the hell a WebAuthn is, so passkeys are the introduction to the whole stack for most people.
WebAuthn is the JavaScript API to access the USB devices speaking U2F to the browser.
FIDO2 extends the WebAuthn API by also offering to store security tokens inside of a device's TPM, by using CTAP2 to authenticate with an external device or service, or by using good old U2F. If you're implementing it, you generally only need to deal with the WebAuthn side, the browser will take care of the rest.
You can think of Passkeys as "WebAuthn 1.1". Names like WebAuthn and U2F don't exactly attract the general consumer, so they rebranded it. The same way websites used names like "passwordless logins" when trying to describe WebAuthn+U2F, expect "passkey" seems backed by larger companies.
If you've implemented WebAuthn correctly (I doubt you actually interacted with the U2F API directly), you've also implemented passkeys.
The naming is rather confusing, mostly because a lot of websites used the wrong name for the wrong part of the process. Luckily, almost nobody acfually knows what the hell a WebAuthn is, so passkeys are the introduction to the whole stack for most people.