Passkey Authentication Service  ·  View 09 of 21  ·  Structure

Interface Catalogue

Three inbound interfaces, three outbound, and the fact that none of the outbound three is on the login path.

Editable source SVG draw.io All views
Consumers Relying-party app web SDK and native Relying-party backend 40 tenants Tenant console policy, coverage, recovery Passkey Authentication Service Ceremony and lifecycle APIs REST, mTLS inside Dependencies FIDO Metadata Service signed BLOB Out-of-band provider tenant's own Network HSM PKCS#11 begin, finish verdict mgmt API daily pull recovery msg sign only Passkey Authentication Service — Interface Catalogue External / third party Application we own Security / platform synchronous batch event / async Three inbound interfaces, three outbound. None of the outbound three is on the authentication path; audit export to a tenant SIEM is a pull from the evidence store. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • Ceremony begin and finish are the only interfaces a relying party's client touches; everything a client could get wrong is therefore in two calls.
  • Verdict verification is offline by design: the relying party fetches verification material and checks a signature rather than calling back on every login.
  • The management API, the console and the support-desk tooling are one surface with one authorization model, so there is no second path to a revocation.
  • All three outbound dependencies are off the hot path, which is what lets each one have a named degradation in view 20's failure handling.

Assumptions

  • 40 relying-party backends; per-tenant API credentials scoped to specific RP IDs with no cross-tenant read under any role.
  • Verification material is cached by relying parties for up to an hour, which bounds how fast a key rotation can take effect.

Risks

  • An SDK is the only thing standing between a tenant's front end and a subtly wrong origin check. The gateway re-checks server-side precisely because the SDK cannot be trusted to be current.
◀  Platform Components All views Data Flow  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1009-integration