Add passkeys to the login you already have
Phishing-resistant passkeys let your users sign in with Face ID, Touch ID or a security key instead of a password — on web, iOS and Android. A correct WebAuthn engine you keep your usernames and sessions, we own the ceremony. No password database to breach.
A WebAuthn engine that's correct at the core
Phishing-resistant
FIDO2/WebAuthn credentials are bound to your origin and can't be replayed. A breach yields a public key — nothing to phish or reuse.
Web + native, no client shim
One server for navigator.credentials (web), iOS ASAuthorization and Android Credential Manager. Native registration is parsed from COSE/attestation server-side — same endpoints as web.
Clone detection
Signed-counter tracking flags a cloned authenticator on every sign-in; durable credentials survive restarts.
Step-up for sensitive actions
Bind a passkey to a session to re-authenticate before destructive or high-value actions like account deletion or money movement.
Your data, isolated + auditable
Only public keys and an append-only auth-event log are stored, row-level isolated per tenant in Postgres. No secret to breach.
Stronger recognition
Pairs with glassprint device intelligence for stronger device recognition alongside your passkeys.
Shipping now, and what's next
Today the engine handles the full WebAuthn ceremony, verification, native-app attestation parsing, clone detection and an RLS-isolated credential and audit store — you wire it into your own UI. A browser and native client SDK, conditional-UI autofill, usernameless (discoverable-credential) login and multi-app (multi-RP) configuration are on the roadmap, not yet generally available.
Add passwordless to your app
A correct WebAuthn engine for web, iOS and Android — add passkeys without getting the crypto wrong.