WebAuthn and Passkeys
WebAuthn is a W3C standard for passwordless authentication using public-key cryptography bound to a domain. Passkeys are synchronized WebAuthn credentials stored by platform providers, letting users sign in with biometrics or device PIN instead of passwords.
Technical Architecture & Deep-Dive
During registration the authenticator generates a key pair and returns a credential ID to your server. Authentication challenges prove possession without transmitting a shared secret. Unlike SMS OTP, WebAuthn resists phishing because credentials only respond to the correct RP ID.
APIs rarely verify WebAuthn directly. Identity providers handle ceremonies and issue OIDC ID tokens or session cookies your edge proxy validates. Store only credential public keys server-side, enforce attestation policies for high-assurance tenants, and pair passkeys with step-up MFA for sensitive API scopes.
Key Architectural Benefits
Implement WebAuthn and Passkeys at the Edge
Deploy lightweight API aggregation, edge caching, and secret injection in minutes without Docker containers or complex servers.
Frequently Asked Questions
Q:Can passkeys replace API keys for machine clients?
No. Passkeys authenticate humans in browsers or apps. Machine-to-machine access still needs OAuth client credentials, mTLS, or scoped API keys on the server side.
Related Architecture Concepts
MFA for API access means requiring a second factor before issuing high-privilege tokens or before executing sensitive API operations. Humans authenticate with MFA at the identity provider; APIs enforce step-up scopes or fresh session proof at the gateway.
OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that lets applications verify who a user is. Alongside an access token, the identity provider issues a signed ID token, a JWT containing claims such as the user ID, email, and authentication time.
PKCE, short for Proof Key for Code Exchange, is an OAuth 2.0 extension that protects the authorization code flow for public clients like mobile apps and single-page applications. The client sends a hashed code challenge, then proves possession of the original verifier when exchanging the code for tokens.
OAuth 2.0 is an authorization framework that lets an application obtain limited access to a user account on another service without handling the user password. The user approves requested scopes, and the application receives an access token it uses to call the service API.
Ready-to-Use Edge Recipes
To solve call clerk backend api from client side, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
Webflow is a purely static and frontend visual builder with no backend server. To call private APIs from Webflow custom code without revealing secrets in the browser inspector, route requests through RealComposer. RealComposer stores your API keys in an AES-256-GCM vault, injects credentials at the edge, and handles CORS headers automatically.
To combine firebase auth user with supabase profile endpoint, use one RealComposer pipeline with parallel steps. Firebase ID token lookup and Supabase profile row merged at edge. Your React / Flutter / Mobile app makes one request instead of several sequential upstream calls.