Implement Passkeys

Mon, 01 Jan 0001 00:00:00 +0000

Complete the passwordless prerequisites and choose passkeys only after defining a tested fallback and account-recovery path.

Passkeys (WebAuthn) Authentication

Passkeys use origin-bound WebAuthn credentials with platform or hardware authenticators, which are designed to reduce phishing risk. This Beta implementation has not yet published conformance or abuse-case results.

Browser Compatibility Check

Before implementing passkeys, check if the user’s browser supports WebAuthn:

import { SsoClient } from '@drmhse/sso-sdk';

const sso = new SsoClient({
  baseURL: 'https://sso.example.com'
});

// Check if WebAuthn is supported
if (!sso.passkeys.isSupported()) {
  console.log('Passkeys not supported - show password login instead');
  return;
}

// Check if platform authenticator is available (Touch ID, Face ID, etc.)
const hasPlatformAuth = await sso.passkeys.isPlatformAuthenticatorAvailable();
if (hasPlatformAuth) {
  console.log('Biometric authentication available');
}

Registering a Passkey

Users must register a passkey while authenticated. This is typically done from account settings after the user has logged in with another method.

Implement Magic Links

Mon, 01 Jan 0001 00:00:00 +0000

Complete the passwordless prerequisites and choose magic links only after testing email delivery, expiry, replay, and recovery behavior.

Magic Link Authentication

Magic links provide passwordless authentication by sending one-time login links via email. This is simpler to implement than passkeys and works on any device with email access.

Requesting a Magic Link

async function requestMagicLink(email: string, orgSlug?: string) {
  try {
    const response = await sso.magicLinks.request({
      email,
      orgSlug // Optional: organization context
    });

    console.log(response.message); // "Magic link sent to your email"
    return true;
  } catch (error) {
    if (error instanceof SsoApiError) {
      if (error.statusCode === 429) {
        // Rate limit exceeded
        console.error('Too many requests. Please wait before trying again.');
      } else {
        console.error('Failed to send magic link:', error.message);
      }
    }
    return false;
  }
}

Verifying a Magic Link

When users click the magic link in their email, your application needs to verify the token and complete authentication:

Passwordless Authentication on AuthOS Docs | Auth Operating System API and SDK Guides