Passkeys forevery website

Drop-in passwordless authentication powered by passkeys. Built on OAuth 2.0 and OIDC. Works with any framework, any language, in under five minutes.

Get started free Read the docs

app.js

import { PasskeyBase } from '@passkeybase/js';

const pb = new PasskeyBase({
  clientId: 'pk_live_abc123',
  domain: 'myapp.auth.ing',
});

await pb.loginWithRedirect();

Business impact

Auth that pays for itself

Passkeys aren't just more secure than passwords — they convert better, support cheaper, and lock fewer users out. Public numbers from the brands that have already shipped:

6×: Faster sign-in; Amazon, 175M+ customers on passkeys (Oct 2024).
98%: Sign-in success, vs 32% for passwords; Microsoft Security blog (Dec 2024).
4×: Higher sign-in success than passwords; Google Security blog (May 2023).
26%: Of sign-ins already use passkeys; FIDO Alliance Passkey Index (Oct 2025).

Already shipping passkeys

Apple · Google · Microsoft · Amazon · PayPal · Shopify · GitHub · eBay · Best Buy · Target · TikTok · X · Adobe

See the case studies with sources

How it works

Three steps. Five minutes.

Passwordless auth for your app, end to end.

01
Create a tenant
Sign up and create a tenant on the PasskeyBase dashboard. You get a dedicated auth domain instantly.
02
Add the SDK
Install @passkeybase/js and initialize it with your client ID and domain. One import, one constructor.
03
Users log in with passkeys
Call loginWithRedirect() and users authenticate with Face ID, Touch ID, or Windows Hello. No passwords.

Features

Everything you need for passwordless auth

A complete passkey authentication platform built on open standards. Works for web, SPA, and native mobile.

Passkeys and security keys

Phishing-resistant credentials bound to the origin. Works with platform passkeys (Face ID, Touch ID, Windows Hello) and roaming authenticators like YubiKey. Nothing to phish, leak, or reuse.

Built for SPAs and mobile

OAuth 2.0 + PKCE flow designed for public clients. Your SPA or native app doesn't need a server-side secret — and doesn't need a server at all if you don't have one. PasskeyBase is the auth backend.

Native mobile SDKs

iOS (Swift) and Android (Kotlin) SDKs with built-in passkey flows. Uses ASWebAuthenticationSession on iOS and Custom Tabs on Android — no embedded webviews.

Multiple keys per user

Users can enroll, name, and remove multiple passkeys and security keys from a single account — phone, laptop, hardware key. Self-serve from a hosted account page or your own UI via the SDK.

Works alongside existing auth

Already using Auth0, Cognito, Firebase, or your own login? Add passkeys via enrollment tokens without disrupting your current flow.

Hosted login + account pages

Branded, pre-built login and key-management pages on your tenant domain. Drop in a redirect — no frontend work required.

SDK

Integrate in minutes

The PasskeyBase SDK handles the entire OAuth flow for you. Redirect users to the hosted login page, handle the callback, and get tokens back. That's it.

PKCE-secured OAuth 2.0 flow out of the box
Automatic token refresh and session management
Works with React, Vue, Svelte, vanilla JS, and more

app.js

import { PasskeyBase } from '@passkeybase/js';

const pb = new PasskeyBase({
  clientId: 'pk_live_abc123',
  domain: 'myapp.auth.ing',
  redirectUri: window.location.origin + '/callback',
});

// Redirect to hosted login page
document.getElementById('login')
  .addEventListener('click', () => {
    pb.loginWithRedirect();
  });

// Handle the callback
if (window.location.pathname === '/callback') {
  const { accessToken, idToken } = await pb.handleRedirectCallback();
  console.log('Authenticated!', idToken);
}

Why PasskeyBase

Why not just call WebAuthn yourself?

You can. navigator.credentials.create()is one line, and a demo takes an afternoon. Running passkeys for real users is everything around that line.

What production needs	Building it yourself	With PasskeyBase
Verification	Parse CBOR and COSE keys, check signatures, counters, origin and RP ID, handle every attestation format.	Done server-side on every sign-in, with user verification required.
Challenges	Single-use, expiring challenges bound to the right session, safe against replay and races.	Durable single-use challenges with hard deadlines and replay protection.
Account recovery	Lost phone, new laptop, every passkey gone. The hardest part, and the one support tickets come from.	Recovery runs back through your trusted backend to re-authorize a new passkey.
Sign-in and sign-up	Browsers won't tell you whether someone has a passkey, so one button has to handle both cases.	One Continue with passkey flow for new and returning users.
Sessions and tokens	Issue tokens, refresh them, and make sign-out revoke everything everywhere.	Standard OIDC tokens; sign-out revokes the session and its refresh tokens.
Key management	Screens to list, name, add and revoke passkeys and see active sessions.	A hosted account page, or SDK methods for your own UI.
Browsers and devices	Safari, Chrome and Firefox differ: iframes, popups, cross-device QR sign-in, security keys, mobile app association.	The right path per browser, chosen for you.
Abuse and audit	Rate limits, enumeration resistance, audit logs your security team will ask for.	Built in, per tenant, per client and per IP.
Every platform	Integrate each web framework, mobile app, backend language and CLI separately.	20 language and framework SDKs, plus SSH sign-in for command-line tools.
Keeping up	The passkey spec keeps moving: related origins, immediate mediation, credential signals.	We track it so your integration doesn't change.

PasskeyBase is all of that behind one redirect. Your team ships your product, not an authentication stack.

Ready to go passwordless?

Create a free account and add passkey authentication to your app in under five minutes.

Get started free View quickstart