Passkeys (Beta)

Supersaas comes with a built-in passkey system that you can use in your site. It is powered by Simple Webauthn and works in edge runtimes like cloudflare workers and vercel.

Passkeys in Supersaas are currently in beta.

Concept

Passkeys basically check for the users hardware instead of relying on a password. It's usually fingerprin or faceid.

Registration

1. User enters their email and name
2. We use this data to create a challenge in our backend
3. We send the challenge to the user's browser
4. The user enters their passkey (fingerprint or faceid) and the challenge is verified.
5. We save this passkey in our database.

Login

During login, we prompt the user to enter their email

1. We check if the user has a passkey in our database.
2. If the user has a passkey, we generate a challenge and send it to the user's browser.
3. The user enters their passkey and the challenge is verified respective to what we have in our database.
4. We log the user in.

API Routes

• Creating a challenge when registering - server/api/auth/passkey/register/create-key.js
• Verifying a challenge when registering - server/api/auth/passkey/register/verify-key.js
• Creating a user with a passkey - server/api/auth/passkey/register/create-user.js
• Creating a challenge when logging in - server/api/auth/passkey/login/create-key.js
• Verifying a challenge when logging in - server/api/auth/passkey/login/verify-key.js
• Logging in a user - server/api/auth/passkey/login/login-user.js