Passkeys on your own domain, without running a WebAuthn server.
Users sign in with Face ID, a fingerprint or their screen lock. SignOps creates and checks the challenges and stores the public keys; your page and your domain stay yours.
- 10,000 sign-ins a month free
- Unlimited on Starter
- Web, Android and iOS
Two calls in the browser, two on your server.
Your server asks SignOps for a short-lived token for the user. Our script on your page makes or uses the passkey. Your server confirms the result before it starts a session.
- No WebAuthn library to keep up to date, no challenge store to run.
- Works next to whatever login you have today.
- The same calls on Android and iOS through the SDK.
import { passkeys } from "@signops/web";
// Register: the token comes from your server.
await passkeys.register({
user_id: "usr_8f21c4",
token: registrationToken,
});
// Sign in, with autofill in the email field.
const { signops_token } = await passkeys.signIn({
autofill: true,
});
// Send signops_token to your server to confirm.// A short-lived token for this user.
const { token } = await signops.passkeys.registrationToken({
user_id: "usr_8f21c4",
rp_id: "kiranaexpress.in",
});
// After sign-in, confirm it before starting a session.
const check = await signops.passkeys.verify(
req.body.signops_token,
);See which passkeys each user has.
Each passkey sits under your user id with the device it was made on and when it was last used. Remove one from your server or the dashboard.
- Pixel 8Android · seen nowTrusted for Approve
- iPhone 15iOS · seen 2 h agoPush
- Chrome on WindowsWeb · seen nowPasskey
- Redmi Note 12Android · seen 41 d agoToken expired, removed
Lost the phone? An email code gets them back.
Email OTP sits on the same account. A user without their passkey signs in with a code, then makes a new passkey on the new device.
Email OTPEnter this code to sign in to Kirana Express:
The code expires in 10 minutes. If you did not ask for it, ignore this email.
Nothing to phish, nothing to send.
Phishing does not work
A passkey only answers the domain it was made for. A look-alike login page gets nothing.
Faster than a code
One touch instead of opening an inbox, copying six digits and coming back.
Costs nothing per sign-in
No SMS, no email, no push. Every passkey sign-in is one fewer OTP you pay for.
Details and limits
- Standard
- WebAuthn and FIDO2 passkeys.
- Relying party
- Your own domain, like
kiranaexpress.in. Users see your app's name. - Browsers
- Chrome, Safari, Edge and Firefox on desktop and phone.
- Native apps
- Android 9 and later through Credential Manager; iOS 16 and later through the SDK.
- Synced passkeys
- Google Password Manager, iCloud Keychain and password managers like 1Password.
- Autofill
- The passkey is offered in your email field, with no extra button.
- Passkeys per user
- Up to 10, each named by device.
- Attestation
- Not required, so every passkey provider works.
- Stored by SignOps
- Public keys, credential ids and when each was last used. Never a private key.
- Price
- 10,000 sign-ins a month on Free. Unlimited on Starter and Pro.
Do my users see SignOps anywhere?
No. The passkey is made for your domain, the prompt shows your app's name, and our script runs on your page. SignOps only answers your server.
Can passkeys replace passwords completely?
Yes, or they can sit after a password as the second step. You choose per app, and you can let users choose too.
What happens when a user loses every device?
Send an email OTP, let them in, and ask them to make a new passkey. Their old passkeys can be removed from your server or the dashboard.
Why are passkeys unlimited on Starter?
A passkey sign-in costs a few database reads and one signature check, and sends nothing. Free covers 10,000 sign-ins a month; Starter and Pro have no limit.
Guides for this product
All guidesAdd passkeys this week.
10,000 sign-ins a month on the free plan, unlimited on Starter, on your own domain.