Docs
Add passkey sign-in to your app with any OpenID Connect library, help your users sign in, and understand how Gatekeep keeps accounts safe.
New here? Read What is Gatekeep?, then follow the Quickstart. If you support end users, Help for your users has screenshots of every screen they’ll see.
Getting started
What is Gatekeep?
Hosted passkey sign-in that speaks standard OpenID Connect. What it does, what it doesn't, and the words we use.
Quickstart
Add passkey sign-in to an existing app in about fifteen minutes, using the OpenID Connect library you already have.
How sign-in works
The redirect, the passkey ceremony and the code exchange, step by step, so you know what your app sees at each point.
Integrate
Apps and redirect URIs
What a client ID is, the rules for redirect URIs, and how to run the same app in development, staging and production.
OIDC endpoints
Every endpoint, scope and claim Gatekeep supports, with the discovery document your library reads first.
Next.js with Auth.js
Add Gatekeep to a Next.js app as an Auth.js (NextAuth v5) OIDC provider, with PKCE and no client secret.
Node.js and Express
Sign users in to an Express app with the openid-client library: discovery, PKCE, the callback and a session.
Python
Sign users in to a Flask or Django app with Authlib, using discovery and PKCE with no client secret.
Verify tokens
What's inside a Gatekeep ID token, how to check its Ed25519 signature against your JWKS, and the checks you must not skip.
Refresh tokens
Keep users signed in for up to 30 days with rotating refresh tokens, and what happens when one is stolen.
Single sign-on and logout
How one passkey touch signs users in to all your apps, how to check silently whether someone's signed in, and how to sign them out.
Your users
Signing in
What your users see when they sign in with a passkey, and how to sign in with an email address first.
Creating an account
Sign up with your email address, confirm it from your inbox, and set up your first passkey. No password needed.
Lost your passkey?
Get back into your account with a recovery link when your device is lost, reset or replaced, and what recovery does to your old passkeys.