Notes on passkeys, OAuth and sign-in that can't be phished.
Practical writing on passkeys, OpenID Connect, PKCE, token signing and auth pricing, from the team building Gatekeep's hosted passkey sign-in.
How to add passkey login to Next.js
Add passkey login to a Next.js app with Auth.js and standard OpenID Connect: PKCE, no client secret, protected routes and sign-out, step by step with code.
EdDSA vs RS256 for signing JWTs
EdDSA JWT signing with Ed25519 vs RS256: key and signature sizes, speed, safety, library support, and how to verify EdDSA tokens in Node.js with jose.
Auth0 pricing in 2026, explained
Auth0 pricing explained for 2026: Free, Essentials, Professional and Enterprise tiers, B2C vs B2B plans, how MAU drives cost, and how to estimate your bill.
Auth0 alternatives for passkey-first apps
Comparing Auth0 alternatives for passkey-first apps: hosted Clerk, Cognito, Firebase Auth and Gatekeep, and self-hosted Keycloak, Ory and Authentik.
Account recovery when users lose their passkey
Passkey account recovery done right: synced passkeys, email recovery links, revoking old keys, and trade-offs that keep recovery from becoming a backdoor.
Single sign-on across your own apps, without SAML
Set up single sign-on for multiple apps you own with OpenID Connect instead of SAML: one identity provider session, silent sign-in with prompt=none, and logout.
OAuth PKCE explained, with no client secret
OAuth PKCE explained: how the code verifier and S256 challenge protect the authorization code flow without a client secret, with JavaScript you can copy.
Why passkeys stop phishing (and one-time codes don't)
Phishing-resistant authentication explained: how origin binding lets passkeys defeat adversary-in-the-middle kits that steal one-time codes and push approvals.
Passkeys vs passwords, SMS codes and magic links
Passkeys vs passwords, SMS one-time codes and email magic links: how each works, what attacks it stops, what it costs to run, and where each still belongs.
What are passkeys? A developer's guide
What are passkeys? A developer's guide to WebAuthn public-key credentials: how registration and sign-in work, synced vs device-bound keys, and what to store.
Delete the password field.
Passkey sign-in for every app you ship. Free up to 5,000 monthly active users.