I’m pretty sure it is not implemented: there’s just no interface to configure it with the OpenSSL library binding to Erlang (the OpenSSL version implementing Token Binding). (@voltone can probably confirm this.)

Also, since Chrome has removed support for it, my opinion is that it won’t see widespread adoption, ever. See:

• The intent to remove from Chrome team: Redirecting to Google Groups
• A blog post on this issue: Identiverse 2026 - Identiverse

Maybe you can tell us more: what are you trying to achieve with Token Binding?

Haha you’re probably the only other person on this forum who could guess why I’m looking into token binding. I’m refactoring/forking your wax library so that it is 100% compliant with the webauthn spec (fully tested). However, it looks like most people have just punted on the TokenBinding aspect which is understandable given its lack of adoption.

I’ll likely implement it properly as the spec dictates but leave it up the the end user whether they want to skip the TokenBinding validation step.

Right, the TLS extensions required are not supported by the ssl application.