Passkeys

A device-bound passkey is not synced to other devices. That doesn't necessarily mean you can only sign in on that device though. For example, you can use a phone to approve a sign-in on your computer.

A synced passkey can be copied through an end-to-end encrypted credential provider so it's available on the user's other devices.

In both cases, the private key is never sent to the application server, but "never leaves the device" is accurate only for device-bound credentials.

A passkey always proves control of a cryptographic key: something you have. Whether it provides just that one factor or multiple factors depends on how the authenticator protects that key.

If the authenticator requires a PIN or biometric before using the key, it can act as a multi-factor cryptographic authenticator. The device provides something you have, while the PIN or biometric provides something you know or something you are.

Bearly Secure's passkey flow has a stubbed verification result that always reports failure. It needs to use the SimpleWebAuthn library to check the cryptographic proof on login.

Replace the stub with a real verification call.

1. In src/routes/passkey.ts, import the verifyAuthenticationResponse function from ../auth/passkeys.ts.
2. In the POST /auth/passkey route, replace the stubbed verification object. Pass the following arguments when verifying the authentication response:
   • response: passkeyVerificationInput.response
   • expectedChallenge: the stored challenge from the database
   • expectedOrigin: the rpOrigin (http://localhost:3000 in the default local setup)
   • expectedRPID: the rpID (localhost in the default local setup)
   • requireUserVerification: true
   • credential: passkeyVerificationInput.credential
3. Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.