Build with PasskeyBridge.

What the platform does, the three pillars, the public API surface, the plans, and the keyed-hash privacy model.

The three-pillar model, request lifecycle, shared modules, latency budget, cascade revocation, and how tenants are kept isolated from each other.

How one organization's data is separated from another's: row-level security, code-level scoping on API paths, and what is keyed per organization.

Generate an API key, send a signal to the ingest endpoint, read the response, and make a playbook act on it.

Set up a development environment against the hosted API: the SDK, a sandbox key, a verified ingest call, and the errors you will meet first.

What the DPoP shadow log records, how to read adoption, and what enforcement looks like today.

Configure a receiver stream, promote it so inbound Security Event Tokens are accepted, and confirm a delivery landed.

The two credentials that reach PasskeyBridge, how to mint and send an API key, what each scope gates, signature policy, and how rotation works.

The fifteen mintable API key scopes, what each function checks, the admin super-scope, and the separate scopes for agent delegates and A2A.

Provider selection, normalized carrier signals, billing boundaries, failover settings and measured lookup health.

The identity signal types PasskeyBridge ingests, the ingest request end to end, hard and soft classification, and what is stored and forwarded.

The Enterprise-only intelligence worker: what it analyses, the assessment it writes, the hallucination cross-check, clustering and human review.

How PasskeyBridge asks carrier providers about a number, whose account each lookup uses, what a lookup returns, and how the result reaches the ingest pipeline.

How a signal is classified, what revocation follows, how agent trust scores move, and how events are clustered.

Scoped security responses, ordered receipts, the policy matrix, hosted-RP freezes and step-up, and legacy caller boundaries.

What the Cloudflare Worker in front of api.passkeybridge.io does, which headers it forwards, and which checks run at the origin.

How a playbook matches a signal, what each of the 13 action types changes, and how to build one in the dashboard.

Ready-made playbook configurations for SIM swap, takeover, credential leak and port-out, with what each action actually changes.

Register, authenticate and manage WebAuthn passkeys: nine actions on one console-only function, a fixed relying party and single-use challenges.

The passkey surfaces PasskeyBridge ships, the strings they show, the errors they map, and which patterns are advice rather than shipped behavior.

Issue, verify, present, and revoke W3C Verifiable Credentials using PasskeyBridge's self-hosted VC engine with hybrid post-quantum signatures.

OpenID for Verifiable Credential Issuance (OID4VCI) Pre-Authorized Code flow—credential offers, token exchange, format negotiation, and wallet integration.

Request, present, and verify credentials using OpenID for Verifiable Presentations and Presentation Exchange 2.0.

Revoke, suspend, and reinstate credentials using W3C StatusList2021 bitstrings.

Binding SIM signal hashes, VC subject hashes, and passkey credential IDs into a single auditable trust chain.

Install @passkeybridge/vc-wallet-sdk, issue your first JWT-VC, verify a presentation, and check revocation status from any fetch-capable runtime.

How PasskeyBridge binds carrier-attestation signals to Verifiable Credential subjects for EUDI Wallet interoperability under eIDAS 2.0, without storing PII.

Scoped, time-bound delegates for AI agents: create, verify and revoke one, how trust scoring narrows its scopes, and each endpoint's auth lane.

The agent-to-agent handshake: eight actions, five attestation checks, the trust coefficient, transaction limit tiers, signed step proofs and cache rules.

How agent delegate behavior is scored: the seven signals, when evaluation runs, how scopes narrow and restore, what is recorded, and the Agents tab.

Production cryptography: hybrid ECDSA and ML-DSA signatures, BLAST tunnels, the quantum-seeded DRBG, per-tenant keys, rotation and encryption at rest.

The BLAST tunnel protocol: X25519 key agreement, optional hybrid ML-KEM-768, HKDF-SHA-256 key derivation, AES-256-GCM encryption and session lifecycle.

The shared PII vault: AES-256-GCM at rest, just-in-time decryption for a declared purpose, the decryption audit log, and the console-only migration tool.

How the zero-PII data model maps to GDPR, CCPA and CPRA, SEC Regulation S-ID and SOC 2 readiness evidence, with the mechanism behind each row.

GDPR Art. 15 access and Art. 17 erasure requests: the export pipeline, the tombstoning erasure path, request tracking, and the dashboard UI.

Using the PII vault: decryption helpers, purpose policies in the dashboard, the decryption audit log, and the console-only migration in Settings.

The unauthenticated shield-ntp endpoint: server time, client drift measurement, the two tolerance modes and where each one is actually enforced.

Hybrid post-quantum signing in practice: the two constructions, ML-DSA seed derivation, what pqc_enabled and pqc_level control, and the ML-DSA-87 add-on.

Per-organization ECDSA signing keys: platform-generated and BYOK provisioning, curve tiers, manual rotation with a 24-hour grace window, and checks.

Manual account-name preservation and cleanup: service authorization, exact-count preview, conflict checks, encrypted membership labels and legacy coverage.

How Provenance Guard checks that a request comes from enrolled hardware: a sensor fingerprint, a kinematic handshake and a second device's quorum attestation.

A design for identity continuity across hardware replacement. One minimal action ships: pg_succession records an unsigned succession token.

Ephemeral legacy-format identifiers issued from a keyed-hashed subject, resolvable over TLS or through a BLAST tunnel, and frozen by a hard signal.

Store a short-lived, encrypted proof of a completed verification and check it again later, including from a terminal that cannot reach the identity provider.

Patent application for a browser-resident virtual authenticator. No part of it is implemented; this page says what runs instead.

The design name, the parts that ship, and the per-tenant BYOK and cryptographic-erasure parts that were design intent only. See the PII vault guide.

A patent application with no implementation. What the page describes is not built; the nearest shipped capability is spatial binding, documented here.

Bind OAuth access tokens to client-held asymmetric key pairs to prevent token theft, replay, and AiTM session hijacking.

SLSA scoring of in-toto build statements, Sigstore bundle fields recorded as submitted, and CycloneDX SBOM ingestion, on the Enterprise plan.

Six client-side checks the SDK runs on itself, scored server-side and stored per session for the SDK integrity tab.

Multi-party approved emergency access on Enterprise: severities, approval thresholds, the recorded scope list, the session states and the audit trail.

An opt-in indicator pool on Enterprise: the five actions, the three-reporter floor, how every indicator is keyed before it is stored, and the tab.

27-category anomaly detection engine covering human admin behavior and autonomous agent/A2A threats.

Guardian approval, recovery states, the owner safety delay and veto, registering a replacement dashboard passkey, and legacy behavior and rollout boundaries.

How identity and security tools connect: SCIM 2.0 provisioning, Okta Event Hooks, signal ingest, outbound webhooks, and where SSO lives.

Set up SCIM 2.0 and Okta Event Hooks: connection settings, attributes, group-to-role push, the provisioning log, and the account rule it depends on.

Inbound and outbound webhooks: HMAC-SHA-256 signature checks, the four-attempt retry model, post-quantum proof headers, payloads and the delivery log.

Console-only posture scanning for an Okta org: 25 weighted checks in nine categories, run from the dashboard Posture tab and scored 0-100.

Console-only posture scanning for a Microsoft Entra ID tenant: 25 weighted Graph checks in ten categories, run from the Posture tab and scored 0-100.

Console-only posture scanning for a Google Workspace domain: 25 weighted Admin SDK checks in nine categories, run from the Posture tab, scored 0-100.

Console-only posture scanning for AWS IAM Identity Center: 25 weighted permission-set and Identity Store checks, run from the Posture tab, scored 0-100.

Console-only posture scanning for a PingOne environment: 25 weighted Management API checks in nine categories, run from the Posture tab, scored 0-100.

Posture scanning for a CyberArk Identity tenant: 25 weighted checks in six categories, run from the dashboard Posture tab and scored 0 to 100.

Console-only posture scanning for a OneLogin account: 25 weighted Admin API checks in eight categories, run from the dashboard Posture tab and scored 0-100.

The eight PasskeyBridge posture modules side by side: credentials, check counts, categories, scoring, and the gaps in each provider's coverage.

PasskeyBridge as a Shared Signals transmitter and receiver: stream setup, verifying a receiver stream, the SET contract, subject hashing, CAEP mapping.

Add the read-only PasskeyBridge MCP connector to Claude, approve it with an administrator passkey, what each tool returns, and how to revoke it.

Register a SAML provider, prove a domain by DNS TXT record or emailed token, and turn on federation from the dashboard, with the state of sign-in today.

Self-serve SAML reference: the three tables, two verification methods, what the audit trail records, the public lookup contract and enforced properties.

How Security Event Tokens are signed and pushed to receivers: the queue, ES256 and ES384 per-tenant keys, the post-quantum proof, retries and dead letters.

Tenant metrics and anomaly detection, threshold alert rules dispatched to Slack, PagerDuty, OpsGenie or a webhook, the audit log, and the webhook delivery log.

One request that aggregates audit, data-subject, incident, credential, vault, binding, proof and entropy counts for a period, with explicit truncation flags.

Threshold alert rules for shield-alerting: the five metrics, rule fields and validation, the five-minute sweep, cooldowns, history and acknowledgement.

The four alert channel types, what each receives, how dispatch failures are reported, testing a channel, and composing escalation from several rules.

Every endpoint at api.passkeybridge.io/v1: its auth lane, request and response shape, what it refuses, and the dashboard-only functions not routed there.

The HTTP statuses, x-pb-reason headers and structured codes PasskeyBridge returns, what each one means, and how to trace a failed request.

Nonce consumption on agent-to-agent handshakes, the clock tolerances each endpoint applies, and how a replay refusal differs from a rate-limit refusal.

The four ceilings that can refuse a request, the plan and quota numbers behind them, the three 429 shapes, and how to tell them apart.

Plans, prices and included volume, how Stripe events drive entitlement, how Enterprise overage is invoiced, and what happens while a plan is unpaid.