A passkey is not your fingerprint stored on a website. It is a public-key credential, and the fingerprint prompt is one possible way to authorize its use locally.

That distinction explains both the appeal of passkeys and the engineering work that remains after adding a sign-in button.

This is part one of Passkeys in Production , adapted from the Helpers.work passkeys guide . We build the Passkey Deployment Checker , so this series also explains what a public configuration check can and cannot establish.

The smallest useful mental model

With a password, the user presents a reusable secret. With a passkey, an authenticator answers a fresh challenge using a private key, and your server verifies the response using a public key.

Your server: challenge + authentication options Browser: asks the authenticator for a credential Authenticator: user approval + signed response Your server: verification + application session

Enter fullscreen mode

Exit fullscreen mode

The website never needs the private key.…