fastapi-passkeys: 3 Weeks In — 382 Installs and What Surprised Me

Just over three weeks ago I released fastapi-passkeys — a small open-source library that adds passkey (WebAuthn) login to FastAPI apps, with the security-sensitive parts handled by default. Here's an honest look at the first three weeks.

The numbers

For a brand-new, Alpha-stage library with a niche name, I'll take it. Nobody is getting rich off 382 installs — but it means real people typed pip install fastapi-passkeys and tried the thing, which is the only signal that matters this early.

What surprised me

• The steady drip beats the launch spike. There was no big launch-day bump. Installs have come in a quiet, steady line — mostly, I suspect, from people searching for "passkeys in FastAPI" and finding the repo. That's a good reason to keep writing about it. (I just published a full guide to adding passkeys to FastAPI if you want the walkthrough.)
• People care most about the boring security parts. The questions I get aren't about the happy path — they're about single-use challenges, origin checks, and cloned-authenticator detection. That's exactly the part I wanted the library to own, so it's reassuring.
• It travels with its siblings. The companion library fastapi-trusted-devices (device-bound sessions and revocation) is at 153 installs, and the older unipay-uz payments library is at 359 — people who find one tend to look at the others.

What's next

• Hardening the public API toward a stable 1.0.
• More adapters and a fuller documentation site.
• Suspicious-login and session-hijack hooks in the trusted-devices companion.

If you're building passwordless login on FastAPI, I'd genuinely love for you to try it and tell me where it hurts:

• Install: pip install fastapi-passkeys
• Source & demo: github.com/javlondevv/fastapi-passkeys
• A ⭐ on the repo is the single biggest thing that helps others find it.

Thanks to everyone who's already tried it. More updates as the numbers grow.