Implementing passkeys: From WebAuthn theory to code

Passwordless authentication is rapidly becoming a key part of modern application security.

Our software engineer, Nemanja Vasić, explains passkeys, WebAuthn, and public-key cryptography as a secure alternative to traditional passwords.

Why passkeys are replacing passwords

In his recent talk, Nemanja covered what passwordless applications are and why they are becoming a practical alternative to traditional credentials.

He explained passkeys as a phishing-resistant, user-friendly authentication method built on WebAuthn and public-key cryptography.

Nemanja also walked through the basic architecture, including the client device, the authenticator, the backend service, and the relying party configuration. He used his custom authorization server with BFF (Backend for Frontend) and React on the client side, alongside the passkeys service as a separate project to showcase passkeys registration and authentication flows.

You can find the authorization server here:
https://github.com/GoodbyePlanet/spring-cg-bff

And passkeys service here:
https://github.com/GoodbyePlanet/passkey-service

Passkeys service is a practical Go and Gin implementation of WebAuthn, backed by PostgreSQL for persistence.

How to implement passkeys: From flow to code

Nemanja explained the passkey registration flow step by step, including how the begin and finish phases connect.

He also walked through the authentication flow, showing how the begin and finish endpoints validate returning users with passkeys.

What makes this example useful is that it bridges theory and implementation, so teams can quickly understand what production-ready passkey flows look like.

For anyone moving toward passwordless authentication, these repositories are a clean starting point and reference.

More details can be found on Nemanja’s blog: https://blog.goodbyeplanet.dev/post/passkeys.