Passkey Authentication Service  ·  View 02 of 21  ·  Context and scope

High-Level Architecture

Seven stages, with the limit-and-shed gate before the ceremony plane rather than inside it.

Editable source SVG draw.io All views
Client WebAuthn client browser or app Authenticator holds the private key Edge Ceremony gateway Envoy, TLS, origin check Limit and shed challenges first Ceremony plane Challenge issuer 16 bytes, single use Assertion verifier p99 60 ms Attestation verifier registration only Hot-path state Ceremony store Redis, region-pinned Credential store CockroachDB, replicated Verdict Verdict signer Vault, PKCS#11 HSM Risk engine fails open Warm and cold planes Lifecycle and recovery devices, revocation Control plane tenants, policy, MDS Evidence Audit stream Kafka, buffered Audit store ClickHouse, MinIO outcome revocations Passkey Authentication Service — High-Level Architecture External / third party Interface / broker Application we own Data store Security / platform Queue / topic event / async batch The hot path reads the credential store and mutates the ceremony store. Everything else is a cache, a snapshot or an asynchronous pipeline. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • The hot path reads the credential store and mutates the ceremony store. Nothing else on it is a write, which is what makes the latency target reachable without a distributed transaction in a login.
  • Shedding happens at the edge and sheds challenge issuance before assertion verification: an in-flight ceremony is worth more than a new one.
  • The risk engine sits beside the ceremony plane rather than in front of it, because a risk engine that can fail a login is a risk engine that can take the product down.
  • Audit emission is asynchronous and buffered. A slow evidence pipeline must never be able to slow a ceremony.

Key numbers (assumed)

  • 20,000 authentication ceremonies per second per region at steady state, 5× for 120 seconds at the working-day peak.
  • Assertion verification p50 15 ms, p99 60 ms server-side, excluding the time the user spends touching a sensor.
  • Authentication path availability 99.99% monthly per region; management plane 99.9%.

What this view omits

  • The verdict-signing and risk calls, which view 13 sequences properly rather than squeezing onto a stage boundary.
  • Configuration reads: every service reads a locally cached tenant policy, which would be an arrow from everything to everything.
◀  System Context All views Actors and Their Core Journeys  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1002-high-level