Build with PasskeyBridge.

What the platform does, the three pillars, the public API surface, the plans, and the keyed-hash privacy model.

Three-pillar interaction model, request lifecycle data flow, shared module architecture, latency budget breakdown, cascade revocation mechanics, and multi-tenant isolation guarantees.

How one organization's data is separated from another's: row-level security, code-level scoping on API paths, and what is keyed per organization.

Generate an API key, send a signal to the ingest endpoint, read the response, and make a playbook act on it.

Set up a development environment against the hosted API: the SDK, a sandbox key, a verified ingest call, and the errors you will meet first.

What the DPoP shadow log records, how to read adoption, and what enforcement looks like today.

Configure a receiver stream, promote it so inbound Security Event Tokens are accepted, and confirm a delivery landed.

The two credentials that reach PasskeyBridge, how to mint and send an API key, what each scope gates, inbound and outbound signature policy, and how rotation actually works.

The fourteen mintable API key scopes, what each function actually checks, the admin super-scope, and the separate scope systems used by agent delegates and A2A negotiations.

Signal types, the ingest request end to end, hard and soft classification, and what PasskeyBridge stores and sends on.

The Enterprise-only intelligence worker: what it analyses, the assessment it writes, the hallucination cross-check, clustering and human review.

How PasskeyBridge queries Vonage and Twilio for carrier state, what a lookup returns, and how the result reaches the ingest pipeline.

How a signal is classified, what revocation follows, how agent trust scores move, and how events are clustered.

The deterministic hard and soft classifier, and the four-subsystem revocation the shield-cascade endpoint runs.

What the Cloudflare Worker in front of api.passkeybridge.io does, which headers it forwards, and which checks run at the origin.

How a playbook matches a signal, what each of the 13 action types changes, and how to build one in the dashboard.

Ready-made playbook configurations for SIM swap, takeover, credential leak and port-out, with what each action actually changes.

Register, authenticate and manage WebAuthn passkeys for PasskeyBridge accounts: nine actions on one console-only edge function, a fixed relying party, five-minute single-use challenges, and the hosted relying party for your own domain.

The passkey surfaces PasskeyBridge ships today, the exact strings they show, the error names they map, and which patterns are recommendations for your own application rather than shipped behavior.

Issue, verify, present, and revoke W3C Verifiable Credentials using PasskeyBridge's self-hosted VC engine with hybrid post-quantum signatures.

OpenID for Verifiable Credential Issuance (OID4VCI) Pre-Authorized Code flow—credential offers, token exchange, format negotiation, and wallet integration.

Request, present, and verify credentials using OpenID for Verifiable Presentations and Presentation Exchange 2.0.

Revoke, suspend, and reinstate credentials using W3C StatusList2021 bitstrings.

Binding SIM signal hashes, VC subject hashes, and passkey credential IDs into a single auditable trust chain.

Install @passkeybridge/vc-wallet-sdk, issue your first JWT-VC, verify a presentation, and check revocation status from any fetch-capable runtime.

How PasskeyBridge binds carrier-attestation signals to Verifiable Credential subjects for EUDI Wallet interoperability under eIDAS 2.0, without storing PII.

Scoped, time-bound identity delegates for AI agents: how to create, verify and revoke one, how behavioral trust scoring narrows its scopes, and which auth lane each endpoint answers on.

The agent-to-agent handshake as implemented: seven actions on one endpoint, the five attestation checks, the combined trust coefficient formula, transaction limit tiers, cache renewal and hard-signal invalidation.

How PasskeyBridge scores agent delegate behavior: the seven signals it detects, when evaluation actually runs, how scopes narrow and restore, what activity recording stores, and what the Agents tab shows.

The cryptographic architecture in production: hybrid ECDSA and ML-DSA signatures, BLAST session tunnels, the quantum-seeded DRBG, per-tenant keys and rotation, encryption at rest, and what is still roadmap.

The BLAST tunnel protocol in detail: X25519 ECDH key agreement, HKDF-SHA-256 session key derivation, AES-256-GCM tunnel encryption, stateless session persistence, and lifecycle management.

The shared PII vault module: AES-256-GCM encryption at rest, just-in-time decryption for a declared purpose code, the decryption audit log, and the console-only migration and shredding tool.

How the zero-PII data model maps to GDPR, CCPA and CPRA, SEC Regulation S-ID, and the SOC 2 readiness evidence the platform collects, with the mechanism behind every row.

Data Subject Access Request workflows for GDPR Art. 15 (Right to Access) and Art. 17 (Right to Erasure). Covers the export pipeline, cryptographic shredding implementation, request lifecycle tracking, and the dashboard UI.

Using the PII vault day to day: the decryption helpers, purpose policies in the dashboard, reading the decryption audit log, and running the console-only migration from Settings.

The unauthenticated shield-ntp endpoint: server time, client drift measurement, the two tolerance modes and where each one is actually enforced.

The hybrid post-quantum architecture in practice: the two signing constructions, deterministic ML-DSA seed derivation, what the pqc_enabled toggle and the pqc_level tier each control, and the ML-DSA-87 add-on.

Per-organization ECDSA signing keys: platform-generated and BYOK provisioning through shield-admin-mutations, the curve tiers, manual rotation with a 24-hour grace window, and how to confirm one ran.

Console-only tooling that encrypts legacy plaintext columns into the PII vault and, once coverage is complete, permanently nulls the plaintext originals.

Console-only three-channel device verification: sensor fingerprint, kinematic handshake, and a quorum attestation from a second enrolled device.

A design for identity continuity across hardware replacement. One minimal action ships: pg_succession records an unsigned succession token.

Ephemeral legacy-format identifiers issued from a keyed-hashed subject, resolvable over TLS or through a BLAST tunnel, and frozen by a hard signal.

Store a short-lived, encrypted proof of a completed verification and check it again later, including from a terminal that cannot reach the identity provider.

Patent application 19/576,127 for a browser-resident virtual authenticator. No part of it is implemented; this page says what runs instead.

The PBPBV design name, the parts of it that ship, and the per-tenant BYOK and cryptographic-erasure parts that were design intent only. The working reference is the PII vault guide.

A patent application with no implementation. What the page describes is not built; the nearest shipped capability is spatial binding, documented here.

Bind OAuth access tokens to client-held asymmetric key pairs to prevent token theft, replay, and AiTM session hijacking.

SLSA scoring of in-toto build statements, Sigstore bundle fields recorded as submitted, and CycloneDX SBOM ingestion, on the Enterprise plan.

Six client-side checks the SDK runs on itself, scored server-side and stored per session for the SDK integrity tab.

Multi-party approved emergency access on Enterprise: severities and approval thresholds, the recorded scope list, the session state machine, and the audit evidence it produces.

An opt-in shared pool of indicators on Enterprise: the four actions, the three-reporter floor, what the platform does and does not do about hashing, and the dashboard tab.

27-category anomaly detection engine covering human admin behavior and autonomous agent/A2A threats.

Reference for the social recovery flow: guardian lifecycle, threshold semantics, atomic approval, and the security guarantees enforced in shield-recovery.

How identity and security tooling connects to PasskeyBridge: SCIM 2.0 provisioning, Okta Event Hooks, universal signal ingest, outbound webhook delivery, and where SSO actually lives.

Configure SCIM 2.0 provisioning and Okta Event Hooks against PasskeyBridge: connection settings, what each attribute does, group-to-role push, the provisioning log, and the account rule that decides whether it works.

Inbound and outbound webhooks: HMAC-SHA-256 signature verification on both sides, the four-attempt retry model, the post-quantum proof headers, the payload contract and the delivery log.

Console-only posture scanning for an Okta org: 25 weighted checks in nine categories, run from the dashboard Posture tab and scored 0-100.

Console-only posture scanning for a Microsoft Entra ID tenant: 25 weighted Microsoft Graph checks in ten categories, run from the dashboard Posture tab and scored 0-100.

Console-only posture scanning for a Google Workspace domain: 25 weighted Admin SDK checks in nine categories, run from the dashboard Posture tab and scored 0-100.

Console-only posture scanning for AWS IAM Identity Center: 25 weighted permission-set and Identity Store checks, run from the dashboard Posture tab and scored 0-100.

Console-only posture scanning for a PingOne environment: 25 weighted Management API checks in nine categories, run from the dashboard Posture tab and scored 0-100.

Console-only posture scanning for a CyberArk Identity tenant: 25 weighted Identity Platform checks in six categories, run from the dashboard Posture tab and scored 0-100 by a credit formula unique to this provider.

Console-only posture scanning for a OneLogin account: 25 weighted Admin API checks in eight categories, run from the dashboard Posture tab and scored 0-100.

The eight PasskeyBridge posture modules side by side: credentials, check counts, categories, scoring, and the gaps in each provider's coverage.

PasskeyBridge as a Shared Signals transmitter and receiver: stream configuration, promoting a receiver stream to verified, the signed Security Event Token contract, subject hashing and the CAEP-to-cascade mapping.

Register a SAML provider, prove ownership of an email domain by DNS TXT record or emailed token, and activate federation from the dashboard, with the real button labels, error strings and the state of end-user sign-in today.

Reference for the self-serve SAML lifecycle: the three tables, the two verification methods, what the audit trail actually records, the public lookup contract and the security properties the code enforces.

How PasskeyBridge signs and pushes Security Event Tokens to third-party receivers: the queue, ES256 and ES384 signing with per-tenant keys, the detached post-quantum proof, retry and dead-letter behaviour, and how to operate it.

Tenant metrics and anomaly detection, threshold alert rules dispatched to Slack, PagerDuty, OpsGenie or a webhook, the audit log, and the webhook delivery log.

One request that aggregates audit, data-subject, incident, credential, vault, binding, proof and entropy counts for a period, with explicit truncation flags.

Threshold alert rules for shield-alerting: the five metrics, rule fields and validation, the five-minute evaluation sweep, cooldowns, history and acknowledgement.

The four alert channel types, what each receives, how dispatch failures are reported, testing a channel, and composing escalation from several rules.

Every endpoint reachable at api.passkeybridge.io/v1: the auth lane it takes, its request and response shape, what it refuses, and the dashboard-only functions that are not routed there.

The HTTP statuses, x-pb-reason headers and structured codes PasskeyBridge returns, what each one means, and how to trace a failed request.

Nonce consumption on agent-to-agent handshakes, the clock tolerances each endpoint applies, and how a replay refusal differs from a rate-limit refusal.

The four ceilings that can refuse a request, the plan and quota numbers behind them, the three 429 shapes, and how to tell them apart.

Plans, prices and included volume, how Stripe events drive entitlement, how Enterprise overage reaches an invoice, and what happens while a subscription is unpaid.