Passkey account demo
Sign in without a password.
This demo is a relying party for authz. It runs the OAuth2 Authorization Code + PKCE flow, verifies an Ed25519-signed JWT against authz's published keys, then keeps your session in an HttpOnly cookie.
Log in with a passkeyNo password — tap once on your device.
Authorize
authz checks your passkey and issues a short-lived code; a random state and S256 PKCE verifier guard the exchange.
Verify
The callback token's Ed25519 signature is checked against authz's JWKS, along with iss, aud and expiry.
Session
The verified JWT becomes an HttpOnly, SameSite=Lax cookie — no server-side storage at all.