What is Gatekeep?
Hosted passkey sign-in that speaks standard OpenID Connect. What it does, what it doesn't, and the words we use.
Gatekeep runs sign-in for your apps. Your users prove who they are with a passkey: Face ID, Touch ID, Windows Hello, an Android screen lock or a hardware security key. Gatekeep then sends your app a signed ID token saying who signed in.
Your app never sees a password, because there isn’t one.
What Gatekeep does
- Hosts the sign-in page. Users are redirected to Gatekeep, sign in, and come back to your app.
- Enrolls and verifies passkeys. Including synced passkeys from iCloud Keychain, Google Password Manager and 1Password.
- Verifies email once. A one-time link confirms the address at signup, and gets people back in if they lose every device.
- Issues tokens over OpenID Connect. Authorization code flow with PKCE, signed with Ed25519, verifiable against your public JWKS.
- Single sign-on. One sign-in covers every app you register. Moving between them doesn’t ask again.
What Gatekeep deliberately doesn’t do
Gatekeep asserts one fact: this person controls a passkey registered to this account, and owns this email address. It doesn’t store profiles, roles or preferences. Keep those in your own database, keyed by the user’s sub.
There are no passwords, no SMS codes and no security questions, so there’s nothing to phish, reuse or reset.
Words we use
| Term | Meaning |
|---|---|
| Issuer | Your Gatekeep URL, such as https://acme.gatekeepauth.com or https://auth.yourapp.com. Every OIDC library starts here. |
| App (client) | One of your applications. Each has a client ID and a list of allowed redirect URIs. |
| sub | The user’s permanent, unique ID. Use it as your foreign key. It never changes, even if their email does. |
| MAU | A monthly active user: anyone who signs in at least once in a calendar month. |
Next: Quickstart.