Recently, there have been some more strategic discussions (e.g. [1] or [2]) about the motives of Google and Apple and their passkeys push (if this is a good or bad thing).

The reality is: passkeys cannot be stopped.

They are much simpler and more convenient for consumers (and more secure!). However, there are still many factors to consider and I fully understand that there are many misconceptions, pitfalls, and unknown unknowns, especially for developers. A lot of these stem from the complexity that becomes apparent when one looks behind the surface and tries to really implement psskeys.

I want to share some learnings from the past two years of working on passkey implementations, so that other developers can better anticipate common fallacies, save time, and more easily implement passkeys.

What are your experiences when implementing passkeys?

[1] https://news.ycombinator.com/item?id=40165998 [2] https://proton.me/blog/big-tech-passkey