Passkeys & WebAuthn

Passkeys provide modern passwordless authentication backed by biometric hardware (Apple Touch ID / Face ID, Windows Hello, and hardware security keys like YubiKeys).

How AuthSetu Handles Passkeys

1. **Registration**: The browser requests a cryptographic challenge from `/v1/auth/passkeys/register/begin`.

2. **Device Signing**: The user authenticates locally on their device, which signs the challenge using the hardware private key.

3. **Verification**: The public key is sent to `/v1/auth/passkeys/register/finish`, where AuthSetu validates the attestation signature and stores the credential.

4. **Login**: Instant single-touch biometric verification without entering a password.