Passkey
A passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
Sign in with a key pair
A passkey is a cryptographic credential belonging to an account at a particular service. The service stores the public key; the authenticator manages private key material. During sign-in, the authenticator creates a signed response to a server request. The server checks it using the stored public key. On the web, the application uses WebAuthn for this.
Plan for device changes in the portal
A fictional project platform registers a passkey for account P-24. Depending on the device and requirements, approval may use a device PIN or biometrics, for example. The platform accepts sign-in only after checking the signed response on the server. The visible device approval alone is not an accepted portal session.
Some authenticators allow backup or provider-based synchronisation; other access options remain device-bound. The team must therefore establish how to add another access method, remove a lost credential and recover account access. Synchronisation to any arbitrary new device must not be assumed. The recovery route also needs suitable evidence of account ownership.
After sign-in succeeds, the platform still checks which projects the account may view or change. A passkey does not replace those application permissions.
Sources
Related terms
- WebAuthnWebAuthn is the browser API for public-key sign-in. The server must validate the browser response before accepting authentication.
- HttpOnly cookieHttpOnly prevents direct cookie access by page scripts. Matching requests can still carry the cookie; session and permission checks remain necessary.
- Argon2Argon2 is a family of memory-intensive password hash functions. The variant, memory use and runtime must suit security and operational requirements.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- Attribute-based access controlABAC evaluates access using defined properties and rules. The origin and freshness of those properties are part of the design.
- Role-based access controlRBAC connects permissions to roles and assigns people to those roles. The data scope must be clear alongside the role name.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.