Passkey Authentication Service  ·  View 14 of 21  ·  Runtime

Registration and Admission Pipeline

Seven stages ending in an immutable verdict, or in nothing at all.

Editable source SVG draw.io All views
Begin Challenge issued bound to handle excludeCredentials no duplicates Create Authenticator makes the key pair Verify Client data check origin, type, challenge Attestation statement chain and format Resolve Metadata snapshot signed, may be stale Policy version in force now Admit Admission verdict immutable once written Persist Credential store atomic with verdict Insure Second-route prompt or an acknowledgement Recovery code shown once unverified is allowed refused: nothing persisted Passkey Authentication Service — Registration and Admission Pipeline Application we own External / third party Data store Security / platform Decision point synchronous failure / alternate A registration that cannot be admitted leaves no partial record. The verdict and the credential are written together or not at all. v 1.0 · owner Security & Identity Architecture · date 2026-10

Decisions

  • Authenticator trust is decided once, here, and written down. The authentication path never re-evaluates it, which is what keeps the metadata service off the hot path.
  • A registration with no attestation is accepted where tenant policy allows it, and the credential's provenance is marked unverified rather than the registration being refused.
  • The snapshot's age is recorded on the verdict, so a credential admitted against a stale metadata copy can be found later without guessing.
  • The credential and its verdict are written atomically. A refused registration leaves no partial record to clean up.

Assumptions

  • Challenge at least 16 bytes from a CSPRNG, bound to tenant, handle and one ceremony.
  • Metadata snapshot refreshed daily; a snapshot up to 7 days stale is still used, with the staleness recorded.
  • excludeCredentials is always sent, so duplicate creation is prevented at the authenticator rather than detected afterwards.

Risks

  • Fail-static metadata means a model revoked upstream today can still be admitted today. That window is accepted; what closes it is the re-evaluation job in view 19, not a hot-path lookup.
◀  Critical Flow — One Authentication Ceremony All views Recovery Routes and Their Assurance  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1014-registration-pipeline