Move beyond codes.
A passkey lets a customer sign in or approve an action with a single gesture on a device they already trust — no code to wait for, nothing to type, nothing a fraudster can talk them into sharing.
What is a passkey?
A passkey is a credential made of a private key that stays on the customer's device and a public key registered with the business. Signing in means the device proves it holds the private key, so there is no password or code to intercept, reuse or phish.
Public-key cryptography, without the lecture.
Four steps explain almost everything a buyer needs to know about why passkeys behave differently to a shared secret.
The device creates a key pair
When a customer registers a passkey, their device generates a private key and a matching public key.
You only ever store the public key
The private key never leaves the customer's device or their platform keychain. There is no shared secret in your database to steal.
Sign-in is a signature, not a secret
Your site sends a challenge; the device signs it with the private key. Nothing reusable crosses the network.
The credential is bound to your origin
A passkey created for your domain will not sign a challenge from a look-alike domain, which is what makes it phishing-resistant.
Assure never performs biometric matching.
A customer may unlock their passkey with their device's own mechanism — Face ID, Touch ID, supported Android authentication or a device passcode. That check happens entirely on the device. Assure does not receive, store or match biometric data, and neither do you.
More than a faster login.
The same credential that recognises a customer can also authorise a specific action.
Everyday sign-in
Returning customers authenticate with one device gesture instead of waiting on a code.
Step-up approval
Re-confirm a sensitive action — a payout, a new payee, a permission change — with a fresh signature.
High-risk confirmation
Bind an approval to a specific action so you can show what the customer agreed to, not just that they were logged in.
Reducing message spend
Every authentication that a passkey handles is a verification message you do not pay to send.
Passkeys, one-time codes and passwords.
Each column describes the method, not a shipping Assure feature.
| Password | One-time code | Passkey | |
|---|---|---|---|
| What the business stores | A hash of a secret the customer chose, often reused elsewhere. | Nothing lasting, but a phone number and a message trail. | A public key that is useless to an attacker on its own. |
| Phishing resistance | Low. Passwords are typed wherever they are asked for. | Low. Codes can be read out or relayed in real time. | High. The credential is bound to your origin. |
| Customer effort | Remember, type, reset when forgotten. | Switch apps, wait, read, retype. | One device gesture. |
| Cost per use | Low direct cost, high support and reset cost. | A per-message fee every attempt. | No per-message fee after enrolment. |
| Works on any device | Yes. | Yes, on any phone that receives messages. | Only where passkeys are supported. |
| Reuse across sites | Common, and a major source of account takeover. | Not applicable. | Impossible — each passkey is site-specific. |
Passkeys are excellent. They are not the whole answer.
A rollout plan that ignores these three realities will strand customers.
Support varies by device
Passkeys need a device, operating system and browser that support them. Some customers will not be able to use one yet.
New devices need a path in
A customer on a brand-new phone may have no passkey to use. That moment needs a deliberate, well-secured recovery flow.
Passkeys work best with a companion channel
Pair passkeys with a verified conversation in the customer's messaging app for enrolment, recovery and agent-assisted cases.
Frequently asked.
Fewer codes. Stronger proof.
Authentication for today. Authorization for what's next.