Skip to main content

Authenticate a passkey

Passkeys, and the underlying Web Authentication API are very flexible. There are several authentication flows. We'll adopt a simple, yet effective strategy: You'll prompt the user to select a passkey, then use it to authenticate.

Prerequisites​

We assume you've already followed the steps in the passkey registration tutorial and registered a passkey. We'll also assume you have your Tenancy ID, Client ID and API Key to hand.

Create a Passlock instance​

We'll use the Passlock class again:

import { Passlock, PasslockError } from '@passlock/client'

const passlock = new Passlock({ tenancyId, clientId })

Authenticate the user​

You'll need to trigger the authentication request in a click handler or similar user initiated event. Browser's don't allow unsolicited authentication requests.

const result = await passlock.authenticatePasskey({ userVerification: 'discouraged' })

if (PasslockError.isError(result)) {
  ...
} else { 
  ...
}

Backend processing​

Exactly same as the backend registration processing. Exchange the token for the UserPrincipal:

curl -s -H "Authorization: Bearer $API_KEY" "https://api.passlock.dev/$TENANCY/token/$TOKEN" | jq
output
{
  "token": "2arafoq-8coasjl-qx4jz3x",
  "sub": "khXCYCxcGwJTLoaG6kVxB",
  "email": "jdoe@gmail.com",
  "givenName": "John",
  "familyName": "Doe",
  "emailVerified": false,
  "authType": "passkey",
  "userVerified": false,
}

Once you've obtained the Principal from Passlock, you can use the sub to lookup the user in your database.

tip

Don't use the Passlock token as a session key, use it for the initial authentication only. Use your own framework specific mechanism to manage sessions.