r/passkey

PayPal has been shoving in my face for months to create a passkey. I use 1password so I gave in today and set one up.

Logging in now defaults to asking for passkey which the 1password extension happily provides. Okay.

Out of curiousity, I tried to login from a browser that does not have 1password extension. PayPal didn't even bother to ask for a passkey and straight away showed the normal email+pw login mask.

1. If I can't remove the normal password fallback, how are passkeys more secure?!
2. Is there really no other way to provide a passkey other than through the browser extension? Sounds flawed, but.. maybe I'm just not getting something here.

I’ve spent the last week trying to roll native Passkey support into our database/auth schema without pulling in a massive external provider. I thought it would be a simple browser API call, but holy crap. Decoding the attestationObject from raw binary array buffers, parsing CBOR payload maps in Node, extracting the raw COSE public key format, and mapping the credential IDs safely to a SQL schema, it feels like you need a PhD in cryptography just to let a user touch their FaceID.

Has anyone successfully built a lightweight, pure TypeScript handler for this without exploding their client-side bundle or relying on a bloated third-party library? How are you handling fallback when a device drops cross-platform WebAuthn support?