Passkey authentication for your users, without writing WebAuthn code
Passkey authentication lets your users sign in with the fingerprint reader, face scan or screen lock of the device they already hold, instead of a password. The Skycloak Platform is built to handle the passkey side for you, so your application keeps its standard OpenID Connect sign-in and your users get the easier, safer login.
How a passkey works
A passkey is a key pair created by the user's device for one website. The private key never leaves the device or the user's password manager, and the site keeps only the public key. At sign-in the site sends a challenge, the device signs it after the user unlocks it, and the site checks the signature.
Because the browser only offers a passkey to the site it was created for, a fake sign-in page on another address cannot use it, and because the site stores no secret, a leaked database gives an attacker nothing to replay. That is why passkeys remove most phishing and password reuse attacks at once.
What the Platform takes on
Passkeys are on the Platform's plan, built on go-webauthn, a maintained implementation of the WebAuthn standard. The Platform shows the passkey prompts on your tenant's sign-in page, stores the public keys, and handles the cases that take the most time to get right: a user with several devices, a lost phone, and the moment a password user is offered a passkey.
Your application changes nothing. It redirects to your tenant as before and receives the same tokens, whether the user typed a password or touched a sensor.
Moving users without losing their passkeys
Many teams hold back on passkeys because a later change of provider would force every user to enrol again. The Platform's plan includes a move from Keycloak that imports users together with their passwords, multi-factor settings and passkeys, so nobody has to start over on the day you switch.
Passwords stay available as a fallback for as long as you want them, so you can introduce passkeys gradually. We describe a feature as available only once it has shipped, so a demo is where you see what you can use today.
Frequently asked questions
Do passkeys replace passwords completely?
They can, but you do not have to start there. Most products offer a passkey alongside the password first and let users switch at their own pace.
What happens when a user loses their phone?
Passkeys stored in Apple, Google or a password manager sync to the user's other devices. A user with no other device recovers the account through the recovery steps you set for your tenant.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.