Supakeys

Why Supakeys?

There are many ways to implement passkey authentication. Here's why Supakeys is a great choice for Supabase projects.

Designed for Supabase

  • Native Integration: Works directly with Supabase Auth and Edge Functions
  • RLS Compatible: All passkey data is protected by Row Level Security
  • Session Management: Creates standard Supabase sessions on successful authentication
  • No External Services: Everything runs in your Supabase project

Security First

  • WebAuthn Spec Compliant: Built on the official WebAuthn standard
  • SimpleWebAuthn: Uses the battle-tested SimpleWebAuthn library
  • Challenge TTL: Challenges expire after 5 minutes
  • Single-Use Challenges: Each challenge can only be used once
  • Rate Limiting: Built-in protection against brute force attacks
  • Audit Logging: All authentication events are logged

Developer Experience

  • TypeScript First: Full type definitions included
  • Simple API: Just a few methods to learn
  • CLI Tool: Set up your project in minutes
  • Comprehensive Errors: Detailed error codes for debugging

Quick Comparison

FeatureSupakeysDIY WebAuthn
Setup TimeMinutesDays
Supabase IntegrationBuilt-inManual
Security Best PracticesIncludedResearch Required
TypeScript TypesFull CoverageManual
MaintenanceLibrary UpdatesYou

What You Get

Client Package (supakeys)

  • PasskeyAuth class for all authentication operations
  • Support detection utilities
  • Error handling helpers
  • Full TypeScript types

CLI Tool (supakeys)

  • Database migration generation
  • Edge function scaffolding
  • Framework detection
  • Dry-run mode

Edge Function

  • Registration and authentication flows
  • Passkey management (list, update, remove)
  • Rate limiting
  • Challenge lifecycle management

On this page