Python SDK

The passkeybase package provides a Python client for the PasskeyBase Management API. Manage users, credentials, apps, roles, and enrollment tokens from your Python backend.

Installation

Install via pip:

Terminal

pip install passkeybase

Quick Start

Initialize the client with your Management API key and tenant domain, then make your first API call.

main.py

from passkeybase import PasskeyBaseClient

client = PasskeyBaseClient(
    api_key="YOUR_MANAGEMENT_API_KEY",
    domain="myapp.auth.ing",
)

# List all users
users = client.users.list()
for user in users.data:
    print(f"{user.id}: {user.display_name}")

User Management

Create User

Create a user

user = client.users.create(
    external_id="user_123",
    display_name="Jane Doe",
)
print(f"Created user: {user.id}")

List Users

List users with pagination

# List with pagination
users = client.users.list(page=1, per_page=20)

for user in users.data:
    print(f"{user.id}: {user.display_name}")

print(f"Total: {users.pagination.total}")

Get User

Get a user by ID

user = client.users.get("usr_abc123")
print(f"Name: {user.display_name}")
print(f"Passkeys: {user.passkey_count}")
print(f"Last login: {user.last_login_at}")

Update User

Update a user

user = client.users.update("usr_abc123",
    display_name="Jane Smith",
)
print(f"Updated: {user.display_name}")

Delete User

Deletes a user and all their associated passkeys.

Delete a user

client.users.delete("usr_abc123")

Block / Unblock User

Block and unblock

# Block a user (prevents authentication)
client.users.block("usr_abc123")

# Unblock a user
client.users.unblock("usr_abc123")

Credential Management

List Credentials

List all passkey credentials for a specific user.

List credentials

credentials = client.credentials.list("usr_abc123")
for cred in credentials.data:
    print(f"{cred.id}: {cred.device_name} ({cred.authenticator_type})")

Delete Credential

Revoke a specific passkey credential.

Delete a credential

client.credentials.delete("usr_abc123", "pk_xyz789")

Client / App Management

Create App

Create an OAuth app

app = client.apps.create(
    name="My Mobile App",
    redirect_uris=["myapp://callback"],
)
print(f"Client ID: {app.id}")

Rotate Secret

Rotate client secret

new_secret = client.apps.rotate_secret("pk_live_abc123")
print(f"New secret: {new_secret.client_secret}")

Role Management

Create Role

Create a role

role = client.roles.create(
    name="admin",
    description="Administrator role",
)
print(f"Role ID: {role.id}")

Assign Users

Assign users to a role

client.roles.assign_user("role_abc123", "usr_abc123")

# List users in a role
users = client.roles.list_users("role_abc123")
for user in users.data:
    print(f"{user.id}: {user.display_name}")

Enrollment Tokens

Generate a one-time token for enrolling a passkey for an existing user. See the Enrollment guide for the full flow.

Create enrollment token

token = client.enrollment_tokens.create(
    external_id="user_123",
    display_name="Jane Doe",
    expires_in=3600,
)
print(f"Token: {token.token}")
print(f"Expires: {token.expires_at}")

# Return this token to your frontend for passkey enrollment

Error Handling

All API errors raise a PasskeyBaseErrorwith structured error information.

Error handling

from passkeybase import PasskeyBaseClient, PasskeyBaseError

client = PasskeyBaseClient(
    api_key="YOUR_MANAGEMENT_API_KEY",
    domain="myapp.auth.ing",
)

try:
    user = client.users.get("usr_nonexistent")
except PasskeyBaseError as e:
    print(f"Error: {e.error}")       # "not_found"
    print(f"Message: {e.message}")   # "User not found"
    print(f"Status: {e.status}")     # 404

Configuration Options

Configuration

from passkeybase import PasskeyBaseClient

client = PasskeyBaseClient(
    api_key="YOUR_MANAGEMENT_API_KEY",  # Required. Management API key.
    domain="myapp.auth.ing",            # Required. Your tenant domain.
    timeout=30,                         # Optional. Request timeout in seconds. Default: 10.
    max_retries=3,                      # Optional. Max retry attempts. Default: 2.
    base_url=None,                      # Optional. Override API base URL.
)

Option	Type	Required	Description
`api_key`	str	Yes	Your Management API key from the dashboard.
`domain`	str	Yes	Your tenant domain (e.g., myapp.auth.ing).
`timeout`	int	No	Request timeout in seconds. Default: 10.
`max_retries`	int	No	Maximum retry attempts for failed requests. Default: 2.
`base_url`	str	No	Override the API base URL.