Add PasskeyBase with an AI coding agent

Give your coding agent one link. The guide behind it teaches the agent the exact PasskeyBase contract. It adds passkeys to the accounts your app already has, without replacing your login or creating a second user database.

Paste this prompt

Works in Claude Code, Codex, Cursor, Copilot and any agent that can fetch a URL:

Implement PasskeyBase in the current project (guide https://www.passkeybase.com/llm/integrate.md)

The guide is plain Markdown at www.passkeybase.com/llm/integrate.md. Agents that index sites can also start from llms.txt.

Or install the Agent Skill

The skill contains the full guide, so the agent doesn't need network access to use it. It loads automatically when you ask to add PasskeyBase or passkeys.

mkdir -p .claude/skills/passkeybase
curl -fsSL https://www.passkeybase.com/llm/skills/passkeybase/SKILL.md -o .claude/skills/passkeybase/SKILL.md

mkdir -p .agents/skills/passkeybase
curl -fsSL https://www.passkeybase.com/llm/skills/passkeybase/SKILL.md -o .agents/skills/passkeybase/SKILL.md

Use ~/.claude/skills/ instead to make it available in every project.

Keep it in your repository's agent instructions

So future changes keep following the same rules, add a note to AGENTS.md or CLAUDE.md:

## Authentication
PasskeyBase passkeys are added on top of our existing accounts.
Follow https://www.passkeybase.com/llm/integrate.md for any PasskeyBase change.

What the agent will do

1. Survey your user model, sessions, CSRF protection and migrations, then ask for your tenant domain and client credentials.
2. Add a passkey_bindings table that maps your user ID to a PasskeyBase identity.
3. Add Add a passkey. After a recent password check, your backend authorizes hosted enrollment for that user and confirms completion server-to-server before saving the binding.
4. Add Sign in with a passkey: an OIDC login (PKCE, state, nonce) that resolves only through the stored binding and creates your app's normal session.
5. Add tests, then report the callback URLs to register and anything it couldn't verify.

Guardrails built into the guide

• Accounts are never linked or created by email address.
• Browser results such as redirects, popups and postMessage are never treated as proof of login or enrollment.
• Client secrets, tickets and tokens stay on your server. Single-page apps get a small backend.
• If PasskeyBase is unavailable, your existing sign-in keeps working.

Before you start

Create a Regular Web client for your tenant and keep its ID and secret ready. Your tenant must have existing-app enrollment enabled. Otherwise the enrollment API answers 404 not_available, and the agent will report that instead of faking success. To see the finished result, try the live quickstarts: they follow the same guide.