A comprehensive implementation guide for integrating secure, phishing-resistant WebAuthn passkeys while avoiding common security and compatibility traps.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install passkey
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install passkey using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Passkey?
The Passkey skill is designed to help developers navigate the complexities of WebAuthn and FIDO2 implementation. By using Openclaw Skills, developers gain access to a structured approach for deploying passwordless authentication that is both secure and user-friendly. This skill focuses on preventing critical vulnerabilities like replay attacks and phishing by enforcing strict origin validation and unique challenge generation.
Beyond security, this skill addresses the practical challenges of the modern web ecosystem, including platform-specific synchronization behaviors across Apple, Google, and Windows. It provides clear guidance on using established cryptographic libraries rather than manual CBOR parsing, ensuring your authentication layer is built on a foundation of battle-tested code.
Passkey Use Cases
- Deploying passwordless login flows to reduce friction and improve security.
- Implementing phishing-resistant multi-factor authentication (MFA).
- Adding biometric-backed authentication via TouchID, FaceID, or Windows Hello.
- Creating cross-platform authentication experiences using synced passkeys from managers like Bitwarden or 1Password.
How Passkey Works
- The server generates a unique, short-lived challenge (60-120 seconds) and sends it to the client.
- The client application triggers the browser's WebAuthn API to request credential creation or assertion.
- The user provides biometric or PIN verification to their local authenticator.
- The authenticator signs the challenge and returns the cryptographic signature and credential data to the server.
- The server validates the origin, challenge, and signature, ensuring the sign count has incremented to detect potential clones.
- Upon successful verification, the server grants access or stores the new public key in COSE format.
Passkey Setup
To get started with this skill, integrate a battle-tested library into your backend environment:
# For JavaScript/TypeScript environments
npm install @simplewebauthn/server @simplewebauthn/browser
# For Python environments
pip install webauthn
# For Rust environments
cargo add webauthn-rs
Ensure your database schema is prepared to store binary data as base64-encoded strings for Credential IDs and public keys.
Passkey Data Schema & Taxonomy
| Requirement | Description | Storage Format |
|---|---|---|
| Credential ID | Unique identifier for the passkey | Base64 String |
| Public Key | The cryptographic key used for verification | COSE Format |
| Sign Count | Integer to track usage and detect cloning | Unsigned Integer |
| Transports | Hints for the browser (USB, BLE, NFC, internal) | Array of Strings |
| User ID | Persistent internal identifier for the user | String/UUID |
Passkey Advanced Features
- Support for Conditional UI (mediation: 'conditional') to allow passkeys to appear in standard username autocomplete fields.
- Resident key (discoverable credential) management for username-less login flows.
- Cross-device authentication support utilizing QR codes and Bluetooth handshakes.
- Automated testing integration using Virtual Authenticators via Chrome DevTools or CI pipelines.
SKILL.md
Loading
Related Openclaw Skills
Paris
A comprehensive AI-driven guide for navigating Paris as a visitor, resident, student, or tech professional.
Parenting AI Assistant
A sophisticated AI agent skill designed to provide evidence-based, age-appropriate parenting guidance while avoiding common advice pitfalls.
Pandas
A high-performance skill for analyzing, transforming, and cleaning Python DataFrames using efficient vectorized operations and professional best practices.
Paddle
Integrate Paddle payments with subscriptions, webhooks, checkout, and tax compliance.
Passwords Skill
A secure local credential vault with OS keychain integration and encrypted storage designed for AI agent workflows.
Pay
An intelligent financial management skill for optimizing payment methods, maximizing rewards, and securing transactions.
Featured*
