Corbado

Corbado is purpose-built for passkey authentication — WebAuthn/FIDO2 credential registration, login challenge generation, and assertion verification — without requiring teams to implement the WebAuthn ceremony themselves. The managed service handles the cryptographic complexity: generate challenge → user authenticates with biometric/device → Corbado verifies the assertion and issues a session token. For agents building auth flows: the REST API manages the server-side passkey operations; client-side is handled by Corbado's JavaScript SDK or your own WebAuthn client code. Drop-in UI component for quick integration. Corbado also supports identifier-first flows (email/phone → passkey), cross-device auth (QR code), and conditional UI (autofill). Confidence is docs-derived.

REST API at backendapi.corbado.io/v1. Resources: passkey-registration, passkey-login, sessions, users. POST /v1/passkey/register/start initiates passkey registration ({username, displayName}). POST /v1/passkey/register/finish completes registration (WebAuthn credential creation response). POST /v1/passkey/login/start generates login challenge. POST /v1/passkey/login/finish verifies assertion and returns session token. GET /v1/sessions/{token} validates a session token (returns user info). POST /v1/users creates a user without passkey (for pre-provisioning). Frontend: Corbado UI components handle WebAuthn ceremony client-side (navigator.credentials.create/get); backend API handles verification.

API secret auth: Authorization: Basic base64({project_id}:{api_secret}). Credentials from Corbado Developer Panel → Settings. Project-scoped secrets. HTTPS enforced. No OAuth2. Sessions: short-lived JWTs issued by Corbado after successful passkey auth; validate via Corbado session API or JWT public key (JWK endpoint). Webhook signing for event callbacks. Rate limiting: per-project, plan-dependent.

Standard HTTP status codes with JSON error bodies. 400 for invalid WebAuthn response (malformed credential or assertion). 401 for invalid API credentials. WebAuthn ceremony errors: client-side (browser/OS) errors typically bubble up before reaching the API. Cross-device auth: QR code flow involves polling for status. Session tokens: validate before trusting (replay attack prevention built into WebAuthn ceremony). Corbado uptime at status.corbado.com. WebAuthn is phishing-resistant by design — credential is bound to the registered origin.

docs.corbado.com covers WebAuthn concepts, passkey registration/login flow diagrams, REST API reference, JavaScript SDK integration, React/Next.js guides, and mobile SDK (iOS/Android) docs. Getting started: create Corbado account (free), get project ID + API secret, first passkey registration in under 20 minutes. Drop-in UI component (@corbado/react) for quick integration. Developer Panel for testing passkey flows without code. Community via Corbado Discord and GitHub. Documentation quality is good — WebAuthn concepts are explained clearly for developers new to the passkey ecosystem.