> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socket.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Passkeys in SocketFi: WebAuthn-Powered Authentication

> Understand how passkeys work, why SocketFi uses them instead of passwords or seed phrases, and how the SDK abstracts all WebAuthn complexity for you.

Passkeys are the cryptographic foundation of SocketFi. Rather than asking users to create passwords they can forget or seed phrases they can lose, SocketFi uses the WebAuthn standard to generate hardware-backed credentials that never leave a user's device. When a user authenticates, their authenticator signs a challenge with a private key stored in secure hardware — no shared secret is ever transmitted, and your application never touches private key material.

## What Is a Passkey?

A passkey is a public-key credential created by a WebAuthn-compliant authenticator. During registration, the authenticator generates an asymmetric key pair:

```text theme={null}
Authenticator
  ↓
Generate Key Pair
  ├── Private Key  →  Stays inside secure hardware (never transmitted)
  └── Public Key   →  Registered with SocketFi (safe to store)
```

During every subsequent authentication, the authenticator signs a one-time challenge with the private key. SocketFi verifies the signature using the stored public key. Because the private key never leaves the hardware, there is nothing that can be stolen from a server database.

***

## Why SocketFi Uses Passkeys

Traditional authentication mechanisms introduce serious risks for both users and wallet applications.

### The Problem with Passwords

Users routinely reuse passwords across services, choose weak secrets, and fall victim to phishing pages designed to harvest credentials. Even a strong, unique password is a shared secret — once your database is breached, every password-based account is at risk.

### The Problem with Seed Phrases

Classic crypto wallets shift the security burden entirely onto users. A twelve or twenty-four word recovery phrase is easy to lose, photograph accidentally, type into the wrong site, or simply forget. Seed phrase failures are the leading cause of permanent wallet loss.

### How Passkeys Solve Both

Passkeys eliminate shared secrets and manual backup requirements simultaneously. There is nothing for a phishing page to steal, nothing for a database breach to expose, and nothing for a user to write down and misplace.

***

## How WebAuthn Authentication Works

Every authentication request follows the same cryptographic flow:

```text theme={null}
Your Application
  ↓
Authentication Challenge (unique, one-time)
  ↓
User's Authenticator (Face ID / Touch ID / Windows Hello / etc.)
  ↓
Sign Challenge with Private Key
  ↓
Return Signed Response
  ↓
SocketFi Verifies Signature with Stored Public Key
  ↓
Authentication Success
```

Because each challenge is unique, a recorded authentication response cannot be replayed by an attacker. Because the signature can only be produced by the stored private key, only the legitimate device can authenticate.

***

## Supported Authenticators

SocketFi supports all major WebAuthn platform and roaming authenticators.

<CardGroup cols={2}>
  <Card title="Face ID" icon="face-viewfinder">
    Apple devices with Face ID — iPhone X and later, iPad Pro, and Mac models with a Face ID-enabled external display or built-in sensor.
  </Card>

  <Card title="Touch ID" icon="fingerprint">
    Apple devices with a fingerprint sensor — MacBook Pro/Air with Touch ID, iPhone 8 and earlier, and iPad with Home button.
  </Card>

  <Card title="Windows Hello" icon="windows">
    Windows 10 and 11 devices supporting face recognition, fingerprint, or device PIN via the Trusted Platform Module (TPM).
  </Card>

  <Card title="Android Passkeys" icon="mobile">
    Android 9+ devices using the native Credential Manager API, backed by the device's Trusted Execution Environment (TEE).
  </Card>
</CardGroup>

<Card title="Hardware Security Keys" icon="key">
  FIDO2-compliant hardware keys such as YubiKey, Google Titan, or any CTAP2-capable security key. Ideal for high-assurance users and enterprise deployments.
</Card>

***

## Private Keys Never Leave the Device

The most important security property of passkeys is where private keys live. Each platform uses a different hardware security boundary, but the guarantee is the same in every case.

| Platform            | Secure Storage                      |
| ------------------- | ----------------------------------- |
| Apple (iOS / macOS) | Secure Enclave                      |
| Windows             | Trusted Platform Module (TPM)       |
| Android             | Trusted Execution Environment (TEE) |
| Hardware Keys       | On-device tamper-resistant chip     |

SocketFi never receives, stores, or handles private key material. The only cryptographic material that reaches SocketFi servers is the public key (registered once) and challenge signatures (verified on each authentication).

***

## Passkeys vs. Passwords

| Feature                   | Passwords | Passkeys                   |
| ------------------------- | --------- | -------------------------- |
| Phishing resistant        | No        | **Yes**                    |
| Credential reuse possible | Common    | **No**                     |
| Device-backed security    | No        | **Yes**                    |
| Database breach risk      | High      | **Low** (public keys only) |
| Password resets needed    | Yes       | **No**                     |
| Biometric support         | Limited   | **Native**                 |
| Shared secret transmitted | Yes       | **No**                     |

***

## Passkeys vs. Seed Phrases

| Feature                      | Seed Phrases                   | Passkeys      |
| ---------------------------- | ------------------------------ | ------------- |
| User-friendly                | No                             | **Yes**       |
| Easy recovery                | Difficult                      | **Supported** |
| Device-backed security       | Manual (user's responsibility) | **Native**    |
| Onboarding complexity        | High                           | **Simple**    |
| Loss risk                    | High                           | **Low**       |
| Mainstream consumer adoption | Low                            | **High**      |

***

## Passkeys and Wallet Ownership

In SocketFi, a passkey is not just an authentication mechanism — it is the proof of wallet ownership. When a new user registers, their passkey credential is bound to their smart wallet address:

```text theme={null}
Passkey Registration
  ↓
Smart Wallet Deployed
  ↓
Credential Bound to Wallet
  ↓
Future wallet operations require a valid signature from this credential
```

Losing a credential does not mean losing the wallet. Recovery flows replace the bound credential while the wallet address, balances, and ownership remain unchanged.

***

## Developer Experience

You never interact directly with WebAuthn APIs. The SocketFi SDK handles registration challenges, authenticator communication, signature verification, wallet resolution, and session creation behind a single method call:

```typescript theme={null}
const session = await socketfi.authenticate();
```

The SDK manages:

* Generating and validating registration and authentication challenges
* Communicating with the platform authenticator via the browser's WebAuthn API
* Verifying credential responses against SocketFi's backend
* Resolving the authenticated user's wallet
* Creating and returning a signed session token

<Note>
  You do not need to import `@simplewebauthn`, call `navigator.credentials.create()`, or handle CBOR-encoded attestation objects. The SDK handles all of this internally.
</Note>