01
Phishing-resistant foundation
Passkeys are origin-bound and do not expose a reusable password for an attacker to capture.
Traditional signals tell us what a request looks or sounds like. AppKeyId helps prove who is actually behind it, creating a stronger basis for trust.
| Trust signal | Easy for people | Resists imitation | Bound to a controlled credential | Verifiable by software |
|---|---|---|---|---|
| Voice or video recognition | Yes | Limited | — | — |
| Caller ID / sender address | Yes | Limited | — | Partial |
| Shared secret / safe word | Variable | Until exposed | — | — |
| One-time code | Variable | Can be relayed | Channel-dependent | Yes |
| AppKeyId attestation | Passkey UX | Cryptographic proof | Yes | Yes |
Passkeys are origin-bound and do not expose a reusable password for an attacker to capture.
Extend identity assurance beyond login and toward the message, request, or approval itself.
Judge an interaction by verifiable provenance rather than by how convincingly it imitates a human.