Features
Built for modern authentication
PasskeyBase gives you everything you need to add passkey-based, passwordless authentication to any application. Built on open standards, works with any stack.
Features
Everything you need for passwordless auth
A complete passkey authentication platform built on open standards. Works for web, SPA, and native mobile.
Passkeys and security keys
Phishing-resistant credentials bound to the origin. Works with platform passkeys (Face ID, Touch ID, Windows Hello) and roaming authenticators like YubiKey. Nothing to phish, leak, or reuse.
Built for SPAs and mobile
OAuth 2.0 + PKCE flow designed for public clients. Your SPA or native app doesn't need a server-side secret — and doesn't need a server at all if you don't have one. PasskeyBase is the auth backend.
Native mobile SDKs
iOS (Swift) and Android (Kotlin) SDKs with built-in passkey flows. Uses ASWebAuthenticationSession on iOS and Custom Tabs on Android — no embedded webviews.
Multiple keys per user
Users can enroll, name, and remove multiple passkeys and security keys from a single account — phone, laptop, hardware key. Self-serve from a hosted account page or your own UI via the SDK.
Works alongside existing auth
Already using Auth0, Cognito, Firebase, or your own login? Add passkeys via enrollment tokens without disrupting your current flow.
Hosted login + account pages
Branded, pre-built login and key-management pages on your tenant domain. Drop in a redirect — no frontend work required.
Use cases
Three ways to ship passkeys
Greenfield app, existing login, or a legacy system you can't rewrite — there's a path that fits.
Passkeys as primary login
Greenfield apps. Skip passwords entirely. OAuth 2.0 + PKCE redirect to the hosted login page. Five-minute integration.
OAuth flow02Passkeys as 2FA
Keep your existing password / SSO login. Add passkeys as phishing-resistant MFA for every login or step-up for sensitive actions. Satisfies PCI-DSS v4.0 and FedRAMP phishing-resistant MFA requirements.
Passkeys as 2FA03Legacy password-field shim
Vendor app, legacy form, can't change the frontend. Drop in a 3 KB script and the password field becomes a passkey input — submitting a token your backend validates with one API call.
Legacy shimPure SPA or mobile app with no backend? See passkeys for SPAs & mobile. Building agentic workflows? See passkeys for AI & agents.
OAuth flow
OAuth 2.0 Authorization Code + PKCE
PasskeyBase uses the industry-standard OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange). This is the most secure flow for browser-based applications — no client secret is ever exposed to the frontend.
Authorization request
The SDK generates a random code verifier and challenge, then redirects the user to the PasskeyBase hosted login page with the challenge.
User authentication
The user authenticates using their passkey (Face ID, Touch ID, Windows Hello, security key). The browser's WebAuthn API handles the cryptographic challenge.
Token exchange
After authentication, PasskeyBase redirects back with an authorization code. The SDK exchanges this code (with the original code verifier) for an access token and ID token.
Enrollment
Passkey enrollment for existing users
Already have users authenticated through another system? Use enrollment tokens to let them add passkeys without disrupting their existing login flow.
Create enrollment token
Your backend calls the PasskeyBase Management API with the user's external ID to get a one-time enrollment token. This links the PasskeyBase identity to your existing user.
Enroll passkey
Pass the token to the SDK's enrollPasskey() method. It opens a popup where the user creates a new passkey. No redirect needed — the user stays on your page.
Key management
Multiple keys per user, fully self-serve
Real users have a phone, a laptop, sometimes a hardware key. PasskeyBase lets each user enroll, name, and remove multiple credentials independently — through a hosted account page, your own UI via the SDK, or your backend via the Management API.
Hosted account page
{tenant}.auth.ing/account/keys — branded, pre-built UI for users to manage their own keys. Zero integration.
SDK methods
listPasskeys(), renamePasskey(), removePasskey() — build your own settings UI in any framework.
Management API
Server-to-server endpoints for admin and support flows: list, revoke, or audit any user's keys from your backend.
SSH auth
Passkeys for your app, SSH for your CLI
Passkeys are built for the browser. Your CLI tools need something else: a way to log in with the SSH key already loaded in ssh-agent -- no browser round trip, and no device-code screen to babysit. It's Passkeybase's second credential type, sharing one enrollment table and one dashboard with passkeys, and you keep your existing IdP.
Challenge, sign, redeem
A custom OAuth grant: request a challenge, sign it via ssh-agent as an SSHSIG, redeem it at /oauth/token. Same rate limiting, tenancy, and audit trail as every other grant.
No proprietary magic
Stock ssh-keygen -Y sign andcurl can drive the whole flow, or embed @passkeybase/cli in your own tool and let it handle agent discovery and fallback.
Works headless
Agent forwarding into a remote devbox, or a deploy key loaded into an ephemeral agent in CI -- both authenticate with no interactive prompt and no browser.
Ready to go passwordless?
Create a free account and add passkey authentication to your app in under five minutes.