@passlock/browser

Passkey Authentication for TypeScript apps

Next generation passkey authentication for Astro, SvelteKit, Angular and other frameworks.
Project website »
GitHub · Documentation · Quick start · Demo

Key Features

Powerful passkey features for browser applications.

1. 🔓 No lock-in
   Framework agnostic. Standards compliant.

2. 🔑 Domain migration
   Use backend-authorized RP IDs with WebAuthn /.well-known/webauthn support.

3. 🚀 Zero config passkeys
   Works out of the box with sensible defaults.

4. 📱 Credential management
   Programmatically manage passkeys on end user devices

5. 💪 Powerful
   User verification, autofill, roaming authenticators and more.

Register a passkey

Passkey registration starts on your backend. Use @passlock/server to authorize a registration for the application user, return the resulting registrationToken to the browser, then pass that token to registerPasskey.

import { registerPasskey } from "@passlock/browser"

const result = await registerPasskey(
  { registrationToken },
  { tenancyId: "your-tenancy-id" }
)

if (result.success) {
  // Send this code to your backend and verify it there.
  console.log(result.value.code)
}

if (result.failure) {
  console.error(result.error.message)
}

registerPasskey redeems the one-time registration token for WebAuthn creation options, asks the authenticator to create the passkey, and verifies the result with Passlock.

Your backend chooses the RP ID when it authorizes registration or authentication. The browser library does not accept an RP ID directly; it uses the WebAuthn options returned by Passlock. During domain migration, publish the RP ID domain's /.well-known/webauthn file so browsers and authenticators can enforce related-origin eligibility.

More information

Please see the tutorial and documentation