Skip to main content
Passkeys are the cryptographic foundation of SocketFi. Rather than asking users to create passwords they can forget or seed phrases they can lose, SocketFi uses the WebAuthn standard to generate hardware-backed credentials that never leave a user’s device. When a user authenticates, their authenticator signs a challenge with a private key stored in secure hardware — no shared secret is ever transmitted, and your application never touches private key material.

​
What Is a Passkey?

A passkey is a public-key credential created by a WebAuthn-compliant authenticator. During registration, the authenticator generates an asymmetric key pair:
During every subsequent authentication, the authenticator signs a one-time challenge with the private key. SocketFi verifies the signature using the stored public key. Because the private key never leaves the hardware, there is nothing that can be stolen from a server database.

​
Why SocketFi Uses Passkeys

Traditional authentication mechanisms introduce serious risks for both users and wallet applications.

​
The Problem with Passwords

Users routinely reuse passwords across services, choose weak secrets, and fall victim to phishing pages designed to harvest credentials. Even a strong, unique password is a shared secret — once your database is breached, every password-based account is at risk.

​
The Problem with Seed Phrases

Classic crypto wallets shift the security burden entirely onto users. A twelve or twenty-four word recovery phrase is easy to lose, photograph accidentally, type into the wrong site, or simply forget. Seed phrase failures are the leading cause of permanent wallet loss.

​
How Passkeys Solve Both

Passkeys eliminate shared secrets and manual backup requirements simultaneously. There is nothing for a phishing page to steal, nothing for a database breach to expose, and nothing for a user to write down and misplace.

​
How WebAuthn Authentication Works

Every authentication request follows the same cryptographic flow:
Because each challenge is unique, a recorded authentication response cannot be replayed by an attacker. Because the signature can only be produced by the stored private key, only the legitimate device can authenticate.

​
Supported Authenticators

SocketFi supports all major WebAuthn platform and roaming authenticators.

Face ID

Apple devices with Face ID — iPhone X and later, iPad Pro, and Mac models with a Face ID-enabled external display or built-in sensor.

Touch ID

Apple devices with a fingerprint sensor — MacBook Pro/Air with Touch ID, iPhone 8 and earlier, and iPad with Home button.

Windows Hello

Windows 10 and 11 devices supporting face recognition, fingerprint, or device PIN via the Trusted Platform Module (TPM).

Android Passkeys

Android 9+ devices using the native Credential Manager API, backed by the device’s Trusted Execution Environment (TEE).

Hardware Security Keys

FIDO2-compliant hardware keys such as YubiKey, Google Titan, or any CTAP2-capable security key. Ideal for high-assurance users and enterprise deployments.

​
Private Keys Never Leave the Device

The most important security property of passkeys is where private keys live. Each platform uses a different hardware security boundary, but the guarantee is the same in every case. SocketFi never receives, stores, or handles private key material. The only cryptographic material that reaches SocketFi servers is the public key (registered once) and challenge signatures (verified on each authentication).

​
Passkeys vs. Passwords

​
Passkeys vs. Seed Phrases

​
Passkeys and Wallet Ownership

In SocketFi, a passkey is not just an authentication mechanism — it is the proof of wallet ownership. When a new user registers, their passkey credential is bound to their smart wallet address:
Losing a credential does not mean losing the wallet. Recovery flows replace the bound credential while the wallet address, balances, and ownership remain unchanged.

​
Developer Experience

You never interact directly with WebAuthn APIs. The SocketFi SDK handles registration challenges, authenticator communication, signature verification, wallet resolution, and session creation behind a single method call:
The SDK manages:
  • Generating and validating registration and authentication challenges
  • Communicating with the platform authenticator via the browser’s WebAuthn API
  • Verifying credential responses against SocketFi’s backend
  • Resolving the authenticated user’s wallet
  • Creating and returning a signed session token
You do not need to import @simplewebauthn, call navigator.credentials.create(), or handle CBOR-encoded attestation objects. The SDK handles all of this internally.