B2C authentication for consumer apps
B2C authentication is the sign-up and sign-in that a consumer product offers to the public, where anyone can create an account and people expect to get in quickly and safely. The Skycloak Platform is built for it, with passkeys, multi-factor authentication, a breached password check and long sessions for mobile apps on its plan, and with your users' data kept in the United States or the European Union.
How consumer sign-in differs from sign-in for business users
In a business product, an administrator usually creates the accounts or connects the company's identity provider. In a consumer product, people sign themselves up, often on a phone, and many give up if the form is slow or confusing. Because anyone can register, the same sign-up page is also a target for automated account creation and for attackers trying passwords leaked from other sites.
B2C authentication is therefore a balance between a short path for real people and checks that stop abuse. A good setup asks for little at sign-up, offers sign-in methods that do not depend on remembering a password and adds stronger checks where they are needed. It also has to keep up as the number of users grows, and on the Platform that capacity is Skycloak's work rather than your team's.
Passkeys, breached password checks and MFA
Passkeys let a user sign in with the device's fingerprint reader, face unlock or screen lock instead of a password. A passkey is tied to your sign-in address, so a look-alike site cannot capture it and use it later, which protects users against phishing, a common way consumer accounts are taken over. Passkeys are on the Platform's plan, alongside passwords for users who still prefer them.
For passwords, the plan includes a check against the Have I Been Pwned data, which flags passwords that have appeared in known breaches. If that service cannot be reached, sign-in is still allowed and the password is checked against a local copy, so an outside outage does not lock your users out. Multi-factor authentication is on the plan as well, and because the Platform is still being built, a demo shows which of these features have shipped.
Long sessions on mobile and where user data lives
Mobile users expect to stay signed in for days or weeks without typing a password again. The Platform handles this with an offline refresh token, requested with the offline_access scope, which lasts 7 days by default and can be set up to 30 days per app. The token is rotated on each use and reuse of an old one is detected, and that app's logout, a revoke call or an administrator can end it at any time. Browser sessions are kept separate and end with the single sign-on session or at logout.
Each tenant runs in the United States or the European Union, chosen when you create it, and every record stays in that region. Each of your environments is its own tenant, so staging accounts never mix with real customers. Sign-in also does not depend on the Platform's console, which holds no end-user data, so your users can keep signing in even if the console is down.
Frequently asked questions
Can our users keep their accounts if we move from Keycloak?
Yes. The Platform is built to import a Keycloak realm's users with their passwords, MFA settings and passkeys, so nobody has to reset a password on the day of the move. It also serves Keycloak-compatible addresses and token shapes, so your apps keep working.
How long does a mobile user stay signed in?
For as long as the app's offline refresh token is valid, a lifetime you set per app within the default and maximum described above. The token is rotated each time it is used, and the app's logout, a revoke call or an administrator can end it earlier.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.