Authentication
Passkey (WebAuthn)
Passkeys are the modern replacement for passwords — phishing-resistant by design, with no shared secret on Authaz's side. Users sign in with whatever authenticator their device offers: Touch ID, Face ID, Windows Hello, a YubiKey, or a synced passkey from iCloud Keychain / Google Password Manager / 1Password.
# Enable passkeys for an application
curl -X PUT https://your-app.authaz.io/api/v1/applications/{appId}/auth/passkey \
-H "X-API-Key: $AUTHAZ_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "enabled": true }'The Passkey button appears on Universal Login automatically.
How it works#
WebAuthn is a public-key protocol. The user's authenticator generates a keypair scoped to your domain; the private key never leaves the device, and Authaz only ever sees the public key.
The flow has two phases:
Registration — first-time setup, after the user has signed in with another method (or during the verified-email signup flow):
1. Browser asks Authaz for registration options (POST /auth/passkey-provider/register/start)
2. Authaz returns a challenge and the user's ID
3. Browser prompts the authenticator (Touch ID, etc.)
4. Authenticator returns an attestation
5. Browser sends it to Authaz (POST /auth/passkey-provider/register/complete)
6. Authaz verifies the attestation and stores the public key