Docs · Passkeys
Passkey login for Holochain hApps
People sign in to hApp Auth with a passkey: the face, fingerprint or device PIN they already use to unlock their phone. Your site never sees a password because none exists.
The ways in
| Credential | Role | Rules |
|---|---|---|
| Passkey | The account’s way in | Offered in the browser’s autofill (conditional mediation); the person’s passkey list stays in sync through the WebAuthn Signal API; the account page suggests a second passkey on another device |
| GitHub | A way to start, then a linked identity | The GitHub account id, login and creation date are kept as evidence, and travel in the github claim when a site asks |
| Email code | Starting and recovery | Six digits, ten minutes, single use. Binding the code to the browser session that asked is coming |
There are no passwords. A first sign-in through GitHub or an email code offers a passkey for next time: one touch, and skippable.
Coming back
- Session alive and the site already allowed: no touch at all, straight back to the site.
- Session expired: one passkey touch, offered in the autofill.
- The site asks for something new: the consent screen shows only the new line.
Recovery
Email recovery is on by default, because most people lose a device sooner or later. A passkey added through email recovery sends a notice to every verified address and holds account-level actions (linking keys, issuing attestations, connecting agents) for seven days, so a hijacked mailbox cannot quietly make someone else’s key “the same person”.
On the account page a person can switch recovery off: “Only my passkeys can open this account.” It needs two passkeys first. From then on nobody, including us, can restore the account, and the screen says exactly that before the switch moves.
What your site does
Nothing special: the passkey ceremony happens on happauth.com, and your site receives an ordinary ID token. Read auth_time to see when the person last signed in. Coming acr will say how they signed in this session (urn:happauth:loa:passkey, …:github, …:email or …:agent), so you can ask again for a passkey before anything that matters on your site. The values are listed on OpenID Connect for Holochain.
The trade we make
A design where the person holds a 24-word root that nobody can ever reset is more sovereign, and it reaches fewer people: a desktop app, no phone, no recovery. hApp Auth is a passkey with email recovery the person can switch off, and it works on every phone and browser. The part that must be sovereign, the agent keys and source chains, never passes through hApp Auth in either design.