Phishing-resistant login, without owning your auth.
A FastAPI library that adds passkey / WebAuthn login — the “sign in with Face ID or fingerprint” standard — without taking over the rest of your authentication.
WebAuthn is the strongest login we have and the easiest to implement subtly wrong, leaving a lock that looks closed but isn't.
WebAuthn is the strongest mainstream authentication we have and the easiest to implement subtly wrong. Skip an origin check, reuse a challenge, ignore the signature counter, and you have built a lock that looks closed and isn't. Secure-by-default means the unsafe path should be the one you have to go out of your way to take.
The library owns exactly one thing: ceremony verification. Single-use, TTL-bound challenges. Strict origin and relying-party validation. A monotonic signature counter that detects cloned authenticators. Credential and challenge storage sit behind async protocols, with in-memory, stateless, SQLAlchemy, and Redis adapters supplied. The clone-detection ratchet only turns one direction — like the counter it models. I drew it that way because that's what it is.
It is auth-agnostic and ORM-agnostic on purpose. It verifies the passkey and returns the user — your session, your JWT, your database, your call, exposed through explicit hooks. Owning only the hard security problem is the whole point: a library should be small where it is dangerous and silent everywhere else. Alpha, and I say so. An archive records the date and the revision; it doesn't pretend the ink is older than it is.
It performs the cryptographic ceremony correctly — challenges, origin checks, clone detection — and hands you back the verified user, so the secure path is the default one.
Secure-by-default WebAuthn