Add Passkey Login to an App You Built With AI
Passkey login replaces passwords with your device's biometrics through WebAuthn. Here's how to have an AI coding agent wire it into your app properly.
An AI coding agent will happily generate a working email-and-password auth flow in minutes. What it usually won't volunteer is the newer option sitting next to it: passkeys — sign-in backed by your device's fingerprint, face, or PIN instead of a shared secret your server has to protect. For an app you built quickly and now want people to actually trust, passkeys remove both the password-reset queue and the largest class of credential breach. Adding them isn't a checkbox, though; WebAuthn has moving parts that naive implementations get subtly wrong. Here's what you're actually asking for, and how to have the agent do it properly.
Why passkeys beat passwords for a small app
Passwords cost you three things: storage you must hash carefully, resets you must support forever, and exposure every time another site leaks. Passkeys collapse all three. The credential is a key pair generated on the user's device — the private half never leaves it — so your database holds only a public key that's useless to whoever steals it. Sign-in becomes a cryptographic challenge the device answers after a local biometric check. Modern browsers and operating systems sync passkeys through the user's platform account, so losing one phone no longer means losing the account. For a side project with no security team, this is genuinely less work to keep safe than passwords, not more.
Connect the Claude or Codex you already pay for — the rest runs on workers that cost a fraction.
Download meshcode →What WebAuthn actually involves
Understand the shape of the thing before prompting, because "just add passkeys" undersells it. Registration and login are two distinct ceremonies. On registration, the browser's WebAuthn API asks the platform authenticator to create a key pair scoped to your domain; your app receives a public key plus a credential ID to store. On login, your server sends a random challenge, the device signs it, and the server verifies the signature against the stored public key. None of this should be hand-rolled: every mainstream stack has maintained libraries that handle encoding, verification, and the edge cases. Your job is choosing one and integrating it well — precisely the kind of bounded task an agent does well.
How to ask the agent for it
Vague prompts produce demo-grade results. Ask for specifics: pick a current, maintained WebAuthn library for our stack; add a registration ceremony and a login ceremony; store credentials in their own table linked to users, with the credential ID, public key, sign counter, and device metadata we'll want for support; require user verification so a stolen, unlocked laptop can't sign in as someone else; keep the existing password flow working during rollout. If your data layer doesn't exist yet, sort that first, since credentials need a real home — see how to add a database to an AI-built app.
The details agents get wrong
Three spots deserve a manual read of whatever the agent produces. First, relying-party ID and origins: passkeys are cryptographically bound to a domain, and code tested against localhost must list your production origin too, or every real login fails while the demo worked fine. Second, recovery: a passkey-only account with no recovery path locks people out when they lose every device, so decide deliberately whether you keep a password fallback, issue one-time recovery codes, or accept the tradeoff — and say so plainly in your UI. Third, the ceremony plumbing: challenge storage, replay protection via the sign counter, and honest error messages are where quick implementations quietly cut corners. Auth is exactly the kind of change that deserves the discipline in AI coding agent security and code review before it ships.
Test on real devices before announcing it
Passkey behavior varies across browsers, platforms, and password managers in ways no emulator shows. Register on a desktop, sign in on that machine, then try a phone carrying the synced credential — then try the wrong domain to confirm the whole thing fails closed rather than open. Only after that passes should passkeys become prominent in your interface, and even then position them as an addition rather than a surprise replacement for existing users' working logins.
The meshcode angle
Passkey integration touches frontend UI, backend routes, and a schema migration at once — a good fit for parallel agent sessions rather than one long conversation. meshcode is a native desktop app for macOS and Windows where each pane runs its own agent session against the same repo: one pane wires the WebAuthn endpoints, another builds the settings-page UI and migration, a third drafts the device test matrix. Drive the Claude Code or Codex CLI subscription you already have, or start with meshcode's own metered models billed pay-as-you-go with no monthly fee.
👉 Download meshcode — Mac, Windows