Verify Passkeys Overview

Passkeys, also known as FIDO/WebAuthn, is an industry-standard authentication method that is more seamless and secure than passwords. Many consumer apps are adding support for Passkeys, including Google making Passkeys its default sign-in option.

Expand image

Verify enables developers to easily add Passkeys into their existing authentication flows. The Verify API supports passkey registration, public key storage, and auth flows.

Verify Passkeys also offers client-side supported SDKs for iOS and Android that helps you verify users by adding a low-friction, secure, cost-effective, device approval factor into your own mobile application. Get early access to the SDKs.

Twilio is a member of the FIDO alliance that created the Passkeys standard.

• Service : an organization or environment (e.g. stage, prod). Contains configurations for all verification methods available through the Verify platform (SMS OTP, Voice OTP, Email OTP, Passkeys, Push Verification, TOTP). A Twilio [sub]account can have multiple Services. Each Service contains multiple Entities that are not shared across Services.
• Entity : a user or other identity that needs verification. An Entity can contain multiple Factors.
• Factor : a verification method, which involves an exchange of secrets via a communication channel. For factor_type: passkeys , which follows the AES256 algorithm, the Factor contains the (Relying Party) that is used to generate the Passkey. A Factor contains multiple Challenges.

The system follows a client-server architecture where the client generates or receives Passkeys and communicates with the server for verification.

Verify Passkeys involves two main sequences that are shown in the diagrams below:

Passkeys creation and registration: Register (sign up) a user by creating a unique passkey.

Passkeys Authentication: Verify (Sign In) the user by authenticating the registered passkey.

This quick tutorial will cover how to register and authenticate with Passkeys. There are two main components for working with Passkeys:

Browser (Client) APIs. These are standardized and available in modern browsers.

Server APIs. Twilio Verify is providing the server side passkey storage and validation.

The steps to register a passkey are:

[Server - Twilio] Create a passkey factor

[Client - Browser] Register a passkey with the factor details

[Server - Twilio] Verify passkey registration

Initiate the process of creating a new Passkey registration.

Use the next_step response to create a passkey in the browser with navigator.credentials.create(). The navigator.credentials.create method requires certain parameters to be encoded.

We recommend using the create() wrapper provided by the webauthn-json library for easier encoding and decoding. The capability provided by this library will eventually be browser native. Open the developer console for your browser while on a twilio.com page (domain matching is part of the Passkeys spec) and copy the following code:

This loads the webauthn-json library into your browser console. Assign the JSON response from step 1 to a variable:

Next, copy the following code to the browser console create a passkey credential:

Follow the prompts to register a passkey with the password manager of your choice then copy the credential to use in the next request. In the browser console run the following to copy the JSON request body to your clipboard:

Complete the Passkey registration by passing the response from the navigator.credentials.create() request to below endpoint with the content parameter.

The steps to authenticate with a Passkey are:

[Server - Twilio] Create an authentication challenge.

[Client - Browser] Fetch the passkey with the challenge data. The browser will sign the challenge with the passkey.

[Server - Twilio] Validate the signature and approve the authentication challenge.

Use the next_step response to get the passkey in the browser with navigator.credentials.get(). Like registration, we recommend using the get() wrapper provided by the webauthn-json library for easier encoding and decoding. In the developer console, paste the following code to assign the JSON response from step 1 to a variable.

Next, add the following code to the browser console to get the passkey credential:

Follow the prompts to register a passkey with the password manager of your choice then copy the credential to use in the next request. In the browser console run the following to copy the JSON request body to your clipboard:

Complete the authentication of a Passkey registration by passing the response from the get() request to the passkey verification check endpoint with the content parameter.