Passkey auth library for web apps

Hacker News

Share card

Passkey auth library for web apps

Hi Everyone For the past 6 months or so I've been working on a passkey authentication library/framework. What motivated me to do this? Every project I've worked on required authentication - typically username/password + two factor auth. Doing this properly is hard, making the process frictionless is even harder. Auth0, AWS Cognito etc. have become pretty bloated over the years and you're kinda locked in. Passkeys are both secure (much more so than passwords) AND frictionless. There are a few libraries out there (e.g. SimpleWebauthn - which is great) but due to the cryptographic element, they have pretty specific backend requirements e.g. Node 20+. I wanted to offload the backend aspect to the cloud, so devs using Cloudflare, Vercel, .NET, Django or anything else could adopt passkeys. Whilst the main focus is passkeys, I've also included some broader authentication features. Demos: https://passlock.dev/#demo and https://d1rl0ue18b0151.cloudfront.net (SvelteKit project) Features: - Passkey registration & authentication - Biometrics (e.g TouchID, FaceID) - Social sign in (currently only Google) - Mailbox verification mails - User management console - Audit trail Features I'm currently working on: - JWTs (Verify auth claims locally) - Notification emails (e.g. Login from a new device) - More browser/device workarounds (Browsers often don't comply with the standards!) - Starter projects/templates for different frameworks At some point I may release a self-hosted backend (probably as a Docker image). For now I'm hosting it myself, but AWS have been awesome, providing me with a load of credits I've built a starter project/template for SvelteKit, and I hope to develop some more. I'd love to know what tech stack you're using so I can put together some samples. Regardless of whether anyone uses Passlock, I really hope we can all move away from passwords and start adopting passkeys :)