Passkey SDK Kit

A modern JavaScript/TypeScript SDK for implementing passkey authentication in web applications. This SDK provides a simple and secure way to register and authenticate users using WebAuthn passkeys.

Note: This SDK is for web-based applications only.

Features

• 🔐 Secure Authentication: Uses WebAuthn standards for passkey authentication
• 🌐 Web Only: Designed for browser environments
• 🔧 Easy Integration: Simple API for quick implementation
• 📦 TypeScript Support: Full TypeScript definitions included

Cross-Platform Support

For Mobile Applications (Android & iOS): If you want to set passkey for Android and iOS both, the same API key can be used. You need to provide the following information:

• Android APK KeyHash
• Apple TeamId
• Android packageName
• Android SHA-256 certificate fingerprints

For more details, refer to passkey-sdk-kit-mobile

Step-by-Step Integration Guide

Step 1: Installation

npm install passkey-sdk-kit

Step 2: Subscription Setup

To subscribe to the Passkey SDK, follow these steps:

1. Pay the subscription fee.

2. Provide the following platform details:

   • Project Name
   • Platform URL
   • Android APK KeyHash
   • Apple TeamId
   • Android packageName
   • Android SHA-256 certificate fingerprints

3. After verification, you will receive:

   • API Key – Used to initialize the SDK instance on the client.
   • Secret Key – Used on your backend to verify JWT tokens signed with HS256.

Step 3: Import and Initialize

import { PasskeySDK } from "passkey-sdk-kit";

const uId = "<unique-user-id>";
const sdk = new PasskeySDK("<API-KEY>");

Step 4: Initialize SDK

await sdk.init(); // Required before any other operations

Step 5: User Registration

const registerPasskey = async () => {
  try {
    await sdk.init();

    const response = await sdk.registerPasskey(uId, {
      email: "[email protected]",
      name: "Test",
    });

    if (response) {
      checkPasskey();
      alert("Passkey added successfully");
    }
  } catch (error) {
    console.error("Error during registration:", error);
  }
};

Step 6: User Login

const loginWithPasskey = async () => {
  try {
    await sdk.init();
    const response = await sdk.loginWithPasskey();

    if (response) {
      const jwtToken = response?.data?.token;
      if (jwtToken) {
        console.log("JWT Token:", jwtToken);
        setLoginStatus(true);
        alert("Logged in successfully");
      }
    }
  } catch (error) {
    console.error("Error during login with passkey:", error);
  }
};

Step 7: Check Passkey Status

const checkPasskey = async () => {
  try {
    await sdk.init();
    const response = await sdk.checkPasskeyStatus(uId);
    if (response) {
      setPasskeyStatus(response?.data?.isPasskeyEnabled);
    }
  } catch (error) {
    console.error("Error fetching passkey status:", error);
  }
};

Step 8: Delete Passkey (Optional)

const deletePasskey = async () => {
  try {
    await sdk.init();
    const response = await sdk.deletePasskey(uId);
    if (response) {
      checkPasskey();
      alert("Passkey deleted successfully");
    }
  } catch (error) {
    console.error("Error deleting passkey:", error);
  }
};

Step 9: Backend JWT Verification

To authenticate the JWT received during login, use this code:

import jwt from "jsonwebtoken";

const response = jwt.verify(jwtToken, secretKey);

// response structure:
{
  exp: 1753094467,
  iat: 1753094347,
  timestamp: 1753094347701,
  uId: "sdc23sdaf4567ertkdsjlk"
}

Use the uId to securely associate or authenticate the user within your platform.

🔐 Registration & Authentication Flow

• During registration, provide a unique identifier (uId) for the user. This will:

  • Be used to register the passkey.
  • Be embedded in the JWT returned by the SDK during login.

• During login, the SDK returns a JWT token.

• On your backend:

  • Verify the JWT using the secret key.
  • Extract the uId from the token payload.
  • Use the uId to authenticate or link to the user session securely.

Browser Compatibility

Requires a browser that supports:

• WebAuthn API
• crypto.getRandomValues()
• Modern JavaScript (ES2020+)

Supported browsers:

• Chrome 67+
• Firefox 60+
• Safari 13+
• Edge 18+

Security Considerations

• Always use HTTPS in production
• Store API keys securely
• Follow security best practices for your application

License

MIT License - see LICENSE file for details.