diff --git a/common/protob/check.py b/common/protob/check.py
index 9c6468216..ddef718c9 100755
--- a/common/protob/check.py
+++ b/common/protob/check.py
@@ -17,6 +17,8 @@ for fn in sorted(glob(os.path.join(MYDIR, "messages-*.proto"))):
             continue
         if prefix == "Nem":
             prefix = "NEM"
+        elif prefix == "Webauthn":
+            prefix = "WebAuthn"
         for line in f:
             line = line.strip().split(" ")
             if line[0] not in ["enum", "message"]:
diff --git a/common/protob/messages-webauthn.proto b/common/protob/messages-webauthn.proto
new file mode 100644
index 000000000..1f2fcdd3d
--- /dev/null
+++ b/common/protob/messages-webauthn.proto
@@ -0,0 +1,56 @@
+syntax = "proto2";
+package hw.trezor.messages.webauthn;
+
+// Sugar for easier handling in Java
+option java_package = "com.satoshilabs.trezor.lib.protobuf";
+option java_outer_classname = "TrezorMessageWebAuthn";
+
+/**
+ * Request: List resident credentials
+ * @start
+ * @next WebAuthnCredentials
+ * @next Failure
+ */
+message WebAuthnListResidentCredentials {
+}
+
+/**
+ * Request: Add resident credential
+ * @start
+ * @next Success
+ * @next Failure
+ */
+message WebAuthnAddResidentCredential {
+    optional bytes credential_id = 1;
+}
+
+/**
+ * Request: Remove resident credential
+ * @start
+ * @next Success
+ * @next Failure
+ */
+message WebAuthnRemoveResidentCredential {
+    optional uint32 index = 1;
+}
+
+
+/**
+ * Response: Resident credential list
+ * @start
+ * @next end
+ */
+message WebAuthnCredentials {
+    repeated WebAuthnCredential credentials = 1;
+    message WebAuthnCredential {
+        optional uint32 index = 1;
+        optional bytes id = 2;
+        optional string rp_id = 3;
+        optional string rp_name = 4;
+        optional bytes user_id = 5;
+        optional string user_name = 6;
+        optional string user_display_name = 7;
+        optional uint32 creation_time = 8;
+        optional bool hmac_secret = 9;
+    }
+}
diff --git a/common/protob/messages.proto b/common/protob/messages.proto
index 86b205f0b..0ad3c5dae 100644
--- a/common/protob/messages.proto
+++ b/common/protob/messages.proto
@@ -237,4 +237,10 @@ enum MessageType {
     MessageType_BinanceOrderMsg = 707 [(wire_in) = true];
     MessageType_BinanceCancelMsg = 708 [(wire_in) = true];
     MessageType_BinanceSignedTx = 709 [(wire_out) = true];
+
+    // WebAuthn
+    MessageType_WebAuthnListResidentCredentials = 800 [(wire_in) = true];
+    MessageType_WebAuthnCredentials = 801 [(wire_out) = true];
+    MessageType_WebAuthnAddResidentCredential = 802 [(wire_in) = true];
+    MessageType_WebAuthnRemoveResidentCredential = 803 [(wire_in) = true];
 }
diff --git a/core/src/trezor/messages/MessageType.py b/core/src/trezor/messages/MessageType.py
index 272753172..a4fb1eb4a 100644
--- a/core/src/trezor/messages/MessageType.py
+++ b/core/src/trezor/messages/MessageType.py
@@ -180,3 +180,7 @@ if not utils.BITCOIN_ONLY:
     BinanceOrderMsg = 707
     BinanceCancelMsg = 708
     BinanceSignedTx = 709
+    WebAuthnListResidentCredentials = 800
+    WebAuthnCredentials = 801
+    WebAuthnAddResidentCredential = 802
+    WebAuthnRemoveResidentCredential = 803
diff --git a/core/src/trezor/messages/WebAuthnAddResidentCredential.py b/core/src/trezor/messages/WebAuthnAddResidentCredential.py
new file mode 100644
index 000000000..f95f352e3
--- /dev/null
+++ b/core/src/trezor/messages/WebAuthnAddResidentCredential.py
@@ -0,0 +1,26 @@
+# Automatically generated by pb2py
+# fmt: off
+import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnAddResidentCredential(p.MessageType):
+    MESSAGE_WIRE_TYPE = 802
+
+    def __init__(
+        self,
+        credential_id: bytes = None,
+    ) -> None:
+        self.credential_id = credential_id
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('credential_id', p.BytesType, 0),
+        }
diff --git a/core/src/trezor/messages/WebAuthnCredential.py b/core/src/trezor/messages/WebAuthnCredential.py
new file mode 100644
index 000000000..a47d2b44a
--- /dev/null
+++ b/core/src/trezor/messages/WebAuthnCredential.py
@@ -0,0 +1,49 @@
+# Automatically generated by pb2py
+# fmt: off
+import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnCredential(p.MessageType):
+
+    def __init__(
+        self,
+        index: int = None,
+        id: bytes = None,
+        rp_id: str = None,
+        rp_name: str = None,
+        user_id: bytes = None,
+        user_name: str = None,
+        user_display_name: str = None,
+        creation_time: int = None,
+        hmac_secret: bool = None,
+    ) -> None:
+        self.index = index
+        self.id = id
+        self.rp_id = rp_id
+        self.rp_name = rp_name
+        self.user_id = user_id
+        self.user_name = user_name
+        self.user_display_name = user_display_name
+        self.creation_time = creation_time
+        self.hmac_secret = hmac_secret
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('index', p.UVarintType, 0),
+            2: ('id', p.BytesType, 0),
+            3: ('rp_id', p.UnicodeType, 0),
+            4: ('rp_name', p.UnicodeType, 0),
+            5: ('user_id', p.BytesType, 0),
+            6: ('user_name', p.UnicodeType, 0),
+            7: ('user_display_name', p.UnicodeType, 0),
+            8: ('creation_time', p.UVarintType, 0),
+            9: ('hmac_secret', p.BoolType, 0),
+        }
diff --git a/core/src/trezor/messages/WebAuthnCredentials.py b/core/src/trezor/messages/WebAuthnCredentials.py
new file mode 100644
index 000000000..6659f98b0
--- /dev/null
+++ b/core/src/trezor/messages/WebAuthnCredentials.py
@@ -0,0 +1,28 @@
+# Automatically generated by pb2py
+# fmt: off
+import protobuf as p
+
+from .WebAuthnCredential import WebAuthnCredential
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnCredentials(p.MessageType):
+    MESSAGE_WIRE_TYPE = 801
+
+    def __init__(
+        self,
+        credentials: List[WebAuthnCredential] = None,
+    ) -> None:
+        self.credentials = credentials if credentials is not None else []
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('credentials', WebAuthnCredential, p.FLAG_REPEATED),
+        }
diff --git a/core/src/trezor/messages/WebAuthnListResidentCredentials.py b/core/src/trezor/messages/WebAuthnListResidentCredentials.py
new file mode 100644
index 000000000..e88ad3976
--- /dev/null
+++ b/core/src/trezor/messages/WebAuthnListResidentCredentials.py
@@ -0,0 +1,14 @@
+# Automatically generated by pb2py
+# fmt: off
+import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnListResidentCredentials(p.MessageType):
+    MESSAGE_WIRE_TYPE = 800
diff --git a/core/src/trezor/messages/WebAuthnRemoveResidentCredential.py b/core/src/trezor/messages/WebAuthnRemoveResidentCredential.py
new file mode 100644
index 000000000..956d8956e
--- /dev/null
+++ b/core/src/trezor/messages/WebAuthnRemoveResidentCredential.py
@@ -0,0 +1,26 @@
+# Automatically generated by pb2py
+# fmt: off
+import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnRemoveResidentCredential(p.MessageType):
+    MESSAGE_WIRE_TYPE = 803
+
+    def __init__(
+        self,
+        index: int = None,
+    ) -> None:
+        self.index = index
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('index', p.UVarintType, 0),
+        }
diff --git a/legacy/firmware/protob/Makefile b/legacy/firmware/protob/Makefile
index 4904f9648..1608b327a 100644
--- a/legacy/firmware/protob/Makefile
+++ b/legacy/firmware/protob/Makefile
@@ -2,7 +2,7 @@ ifneq ($(V),1)
 Q := @
 endif
 
-SKIPPED_MESSAGES := Binance Cardano DebugMonero Eos Monero Ontology Ripple Tezos
+SKIPPED_MESSAGES := Binance Cardano DebugMonero Eos Monero Ontology Ripple Tezos WebAuthn
 
 ifeq ($(BITCOIN_ONLY), 1)
 SKIPPED_MESSAGES += Ethereum Lisk NEM Stellar
diff --git a/python/src/trezorlib/messages/MessageType.py b/python/src/trezorlib/messages/MessageType.py
index d38c70b53..fab7070f0 100644
--- a/python/src/trezorlib/messages/MessageType.py
+++ b/python/src/trezorlib/messages/MessageType.py
@@ -177,3 +177,7 @@ BinanceTransferMsg = 706
 BinanceOrderMsg = 707
 BinanceCancelMsg = 708
 BinanceSignedTx = 709
+WebAuthnListResidentCredentials = 800
+WebAuthnCredentials = 801
+WebAuthnAddResidentCredential = 802
+WebAuthnRemoveResidentCredential = 803
diff --git a/python/src/trezorlib/messages/WebAuthnAddResidentCredential.py b/python/src/trezorlib/messages/WebAuthnAddResidentCredential.py
new file mode 100644
index 000000000..efa17baba
--- /dev/null
+++ b/python/src/trezorlib/messages/WebAuthnAddResidentCredential.py
@@ -0,0 +1,26 @@
+# Automatically generated by pb2py
+# fmt: off
+from .. import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnAddResidentCredential(p.MessageType):
+    MESSAGE_WIRE_TYPE = 802
+
+    def __init__(
+        self,
+        credential_id: bytes = None,
+    ) -> None:
+        self.credential_id = credential_id
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('credential_id', p.BytesType, 0),
+        }
diff --git a/python/src/trezorlib/messages/WebAuthnCredential.py b/python/src/trezorlib/messages/WebAuthnCredential.py
new file mode 100644
index 000000000..05f5091b8
--- /dev/null
+++ b/python/src/trezorlib/messages/WebAuthnCredential.py
@@ -0,0 +1,49 @@
+# Automatically generated by pb2py
+# fmt: off
+from .. import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnCredential(p.MessageType):
+
+    def __init__(
+        self,
+        index: int = None,
+        id: bytes = None,
+        rp_id: str = None,
+        rp_name: str = None,
+        user_id: bytes = None,
+        user_name: str = None,
+        user_display_name: str = None,
+        creation_time: int = None,
+        hmac_secret: bool = None,
+    ) -> None:
+        self.index = index
+        self.id = id
+        self.rp_id = rp_id
+        self.rp_name = rp_name
+        self.user_id = user_id
+        self.user_name = user_name
+        self.user_display_name = user_display_name
+        self.creation_time = creation_time
+        self.hmac_secret = hmac_secret
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('index', p.UVarintType, 0),
+            2: ('id', p.BytesType, 0),
+            3: ('rp_id', p.UnicodeType, 0),
+            4: ('rp_name', p.UnicodeType, 0),
+            5: ('user_id', p.BytesType, 0),
+            6: ('user_name', p.UnicodeType, 0),
+            7: ('user_display_name', p.UnicodeType, 0),
+            8: ('creation_time', p.UVarintType, 0),
+            9: ('hmac_secret', p.BoolType, 0),
+        }
diff --git a/python/src/trezorlib/messages/WebAuthnCredentials.py b/python/src/trezorlib/messages/WebAuthnCredentials.py
new file mode 100644
index 000000000..46a5d9924
--- /dev/null
+++ b/python/src/trezorlib/messages/WebAuthnCredentials.py
@@ -0,0 +1,28 @@
+# Automatically generated by pb2py
+# fmt: off
+from .. import protobuf as p
+
+from .WebAuthnCredential import WebAuthnCredential
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnCredentials(p.MessageType):
+    MESSAGE_WIRE_TYPE = 801
+
+    def __init__(
+        self,
+        credentials: List[WebAuthnCredential] = None,
+    ) -> None:
+        self.credentials = credentials if credentials is not None else []
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('credentials', WebAuthnCredential, p.FLAG_REPEATED),
+        }
diff --git a/python/src/trezorlib/messages/WebAuthnListResidentCredentials.py b/python/src/trezorlib/messages/WebAuthnListResidentCredentials.py
new file mode 100644
index 000000000..404ebed9c
--- /dev/null
+++ b/python/src/trezorlib/messages/WebAuthnListResidentCredentials.py
@@ -0,0 +1,14 @@
+# Automatically generated by pb2py
+# fmt: off
+from .. import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnListResidentCredentials(p.MessageType):
+    MESSAGE_WIRE_TYPE = 800
diff --git a/python/src/trezorlib/messages/WebAuthnRemoveResidentCredential.py b/python/src/trezorlib/messages/WebAuthnRemoveResidentCredential.py
new file mode 100644
index 000000000..e9484e01c
--- /dev/null
+++ b/python/src/trezorlib/messages/WebAuthnRemoveResidentCredential.py
@@ -0,0 +1,26 @@
+# Automatically generated by pb2py
+# fmt: off
+from .. import protobuf as p
+
+if __debug__:
+    try:
+        from typing import Dict, List, Optional
+        from typing_extensions import Literal  # noqa: F401
+    except ImportError:
+        Dict, List, Optional = None, None, None  # type: ignore
+
+
+class WebAuthnRemoveResidentCredential(p.MessageType):
+    MESSAGE_WIRE_TYPE = 803
+
+    def __init__(
+        self,
+        index: int = None,
+    ) -> None:
+        self.index = index
+
+    @classmethod
+    def get_fields(cls) -> Dict:
+        return {
+            1: ('index', p.UVarintType, 0),
+        }
diff --git a/python/src/trezorlib/messages/__init__.py b/python/src/trezorlib/messages/__init__.py
index 8415b1cb1..1310b657b 100644
--- a/python/src/trezorlib/messages/__init__.py
+++ b/python/src/trezorlib/messages/__init__.py
@@ -247,6 +247,11 @@ from .TxRequest import TxRequest
 from .TxRequestDetailsType import TxRequestDetailsType
 from .TxRequestSerializedType import TxRequestSerializedType
 from .VerifyMessage import VerifyMessage
+from .WebAuthnAddResidentCredential import WebAuthnAddResidentCredential
+from .WebAuthnCredential import WebAuthnCredential
+from .WebAuthnCredentials import WebAuthnCredentials
+from .WebAuthnListResidentCredentials import WebAuthnListResidentCredentials
+from .WebAuthnRemoveResidentCredential import WebAuthnRemoveResidentCredential
 from .WipeDevice import WipeDevice
 from .WordAck import WordAck
 from .WordRequest import WordRequest
diff --git a/tools/build_protobuf b/tools/build_protobuf
index 31ba7808e..04bca9e26 100755
--- a/tools/build_protobuf
+++ b/tools/build_protobuf
@@ -20,6 +20,7 @@ CORE_PROTOBUF_SOURCES="\
     $PROTOB/messages-ripple.proto \
     $PROTOB/messages-stellar.proto \
     $PROTOB/messages-tezos.proto \
+    $PROTOB/messages-webauthn.proto \
 "
 
 PYTHON_PROTOBUF_SOURCES=$PROTOB/*.proto
@@ -72,7 +73,7 @@ do_rebuild() {
         sed -i "3ifrom trezor import utils\n" "$DESTDIR"/Capability.py
         sed -i "3ifrom trezor import utils\n" "$DESTDIR"/MessageType.py
         sed -i "/^EthereumGetPublicKey/iif not utils.BITCOIN_ONLY:" "$DESTDIR"/MessageType.py
-        for altcoin in Ethereum NEM Lisk Tezos Stellar Cardano Ripple Monero DebugMonero Eos Binance; do
+        for altcoin in Ethereum NEM Lisk Tezos Stellar Cardano Ripple Monero DebugMonero Eos Binance WebAuthn; do
             sed -i "s:^$altcoin:    $altcoin:" "$DESTDIR"/Capability.py
             sed -i "s:^$altcoin:    $altcoin:" "$DESTDIR"/MessageType.py
         done