This lesson's interactive features are locked, please to keep using them
Passkeys
A passkey is a FIDO credential (similar to a good hardware key) designed to outright replace a password. Instead of being on a physically separate device, it typically lives directly on the user's phone or computer.
Click to play video
Passkeys use the WebAuthn standard on the web. The application receives an asymmetric cryptographic proof and a user-verification result, not the user's PIN or biometric data.
Device-Bound and Synced Passkeys
A device-bound passkey is not synced to other devices. That doesn't necessarily mean you can only sign in on that device though. For example, you can use a phone to approve a sign-in on your computer.
A synced passkey can be copied through an end-to-end encrypted credential provider so it's available on the user's other devices.
In both cases, the private key is never sent to the application server, but "never leaves the device" is accurate only for device-bound credentials.
Can Passkeys Provide MFA?
A passkey always proves control of a cryptographic key: something you have. Whether it provides just that one factor or multiple factors depends on how the authenticator protects that key.
If the authenticator requires a PIN or biometric before using the key, it can act as a multi-factor cryptographic authenticator. The device provides something you have, while the PIN or biometric provides something you know or something you are.
Assignment
Bearly Secure's passkey login flow has a stubbed validation result that always returns an error. It needs to use go-webauthn to validate the cryptographic assertion.
Replace the stub with a real validation call in internal/auth/passkeys/handler.go.
With Bearly Secure still running, run and submit the CLI tests from the project root.