Passkey (WebAuthn) — WebAuthn passkey
Qué es Passkey (WebAuthn)?
Esta entrada está disponible actualmente solo en inglés.
A passkey is a WebAuthn (Web Authentication) credential bound to the user's device and unlocked with biometrics or a device PIN — no phishable code transits, unlike an OTP carried by SMS, email, flash call, or silent network checks. The device signs a fresh challenge with its private key, so nothing reusable travels over the network. It is distinct from TOTP, which reads a code out of an authenticator app, because the device-bound keypair is never shared.
More detail
Passkey is one of the factor channels in Orbit's Verify suite, alongside OTP, flash call, silent network verification, and TOTP. An OTP-based factor sends the user a code to read back; a passkey instead presents a device-bound public-key credential and answers the challenge with a signature, so there is no code to copy, forward, or intercept in transit.
The differentiator from the OTP/SMS/flash-call/SNA route is where the secret lives: OTP factors validate possession of a reachable phone number or inbox, while a passkey validates possession of the enrolled device itself. Phishing resistance comes from that design — a passkey only signs for the origin (domain) it was registered with, so a lookalike page cannot collect a usable response.
Orbit ships the passkey factor in its Verify suite, so a team can offer it as a channel fallback alongside OTP routes or require it outright for higher-assurance flows. A passkey can also replace TOTP-shaped 2FA codes where both sides support WebAuthn; because it is phishable-code-free and bound to the device, it closes the SIM-swap and code-interception weaknesses SMS-based OTP and TOTP entry share.
Preguntas frecuentes
- How is a passkey different from an OTP?
- An OTP sends the user a code over SMS, email, or a flash call and validates the code they type back. A passkey validates a device-bound WebAuthn credential instead — the device signs a fresh challenge and no code ever crosses the network, removing the interception and phishing exposure a code in transit carries.
- Does Orbit ship passkey factors?
- Yes. Passkey is one of the factor channels in Orbit's Verify suite, alongside OTP, flash call, silent network verification, and TOTP. Teams can offer it as a channel route or combine it with OTP fallbacks in one verification flow — see the Verify overview.
- Can a passkey replace TOTP?
- Where both sides support WebAuthn, yes. TOTP works everywhere because any authenticator app can derive codes from a shared secret, but the code still has to be read and typed by the user. A passkey replaces that copy step with a signed challenge, so it is a stronger second factor wherever device-bound credentials are supported.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.