axiom-passkeys

Passkeys

Passkey authentication for iOS apps — registration, assertion, AutoFill-assisted requests, automatic upgrades, combined credential flows, and migration from password-based auth.

When to Use This Skill

Use when you need to:

• ☑ Add passkey sign-in to an iOS app
• ☑ Replace password-based authentication with passkeys
• ☑ Configure ASAuthorizationController for passkey registration or assertion
• ☑ Set up AutoFill-assisted passkey requests (QuickType bar)
• ☑ Add automatic passkey upgrades for existing password users (iOS 18+)
• ☑ Support combined credential requests (passkey + password + Sign in with Apple)
• ☑ Configure associated domains for webauthn/webcredentials
• ☑ Debug passkey assertion failures or missing QuickType suggestions

Example Prompts

"How do I add passkey sign-in to my app?" "My passkeys aren't showing in the QuickType bar" "How do I migrate existing password users to passkeys?" "ASAuthorizationError.canceled — what's going wrong?" "How do I support both passkeys and passwords during migration?" "How do I set up associated domains for passkeys?" "What's the difference between performRequests and performAutoFillAssistedRequests?" "How do I add automatic passkey upgrades on iOS 18?"

Red Flags

Signs you're heading in the wrong direction:

• ❌ Still using passwords as primary auth when passkeys are available — Passkeys are not "extra security." They are the replacement. Every password-only sign-in is a phishing opportunity you're leaving open.
• ❌ Not annotating the username field with .username textContentType — Without this, the system can't associate the field with passkey credentials. AutoFill won't suggest passkeys for unlabeled fields.
• ❌ Using performRequests() for the primary sign-in flow — this shows a modal sheet instead of putting passkeys in the QuickType bar. Use performAutoFillAssistedRequests() for the primary path. Reserve performRequests() for registration and explicit "Sign In" button taps.
• ❌ Setting userVerification to "required" on the server — This prevents sign-in on devices without biometrics. The platform handles verification appropriately per device. Use "preferred" (the default).
• ❌ Creating passkeys in an extension or non-main-app context — Passkey creation requires the main app target. Extensions can perform assertions but not registrations.
• ❌ Not supporting combined credential requests — During migration, users may have a passkey, a password, or neither. A single ASAuthorizationController handles all three. Offering only passkeys locks out users who haven't upgraded.