DOCSEARCHbyAlgolia
Submit Docs

Corbado Flutter Passkeys

repository·main·Indexed 41 days ago

https://github.com/corbado/flutter-passkeys

A collection of Flutter packages for implementing WebAuthn/FIDO2 passkey authentication across Android, iOS, macOS, Web, and Windows. Includes the corbado_auth SDK for passkey and email OTP authentication, corbado_auth_firebase for integrating with firebase_auth, and the corbado_frontend_api_client for direct interaction with the Corbado Frontend API.

Tokens
58.3K
Snippets
226
Records
321
Agent score
51%

What's inside Corbado

  1. Overview of Flutter Passkeys packages

    main

    The flutter-passkeys repository provides several packages to enable WebAuthn/FIDO2-based passkey authentication in Flutter applications. Depending on your backend requirements, you can choose from four main integration paths:

    1. passkeys: The core package for simple passkey authentication. It supports Android, iOS, macOS, Web, and Windows. Use this if you want to connect your own custom relying party (RP) server.
    2. corbado_auth: Built on top of passkeys. It simplifies the process by providing Corbado as a pre-implemented relying party server and includes automatic session refresh to keep users logged in.
    3. corbado_auth_firebase: Built on corbado_auth. It integrates passkeys with Firebase, allowing new users to sign up via passkeys or existing Firebase users to set up and use passkeys. It also includes email OTP as a fallback. Note: This package is currently reported as broken.
    4. supabase integration: Uses the passkeys package as a platform authenticator for supabase_flutter. Supabase Auth acts as the relying party, while passkeys handles the native device prompts.

  3. Overview of Corbado Auth Firebase for Flutter

    main

    The corbado_auth_firebase package enables passkey support for Flutter applications that use firebase_auth. It allows both new users to sign up/log in with passkeys and existing Firebase users to register and use passkeys. It also provides email OTP codes as a fallback mechanism when passkeys are unavailable.

    Platform Support:

    • Android: ✅
    • iOS: ✅
    • Linux: ❌
    • macOS: ❌
    • Web: Not tested
    • Windows: ❌

  4. Overview of Corbado Auth for Flutter

    main

    Corbado Auth is an authentication SDK for Flutter that enables passkey-based authentication (WebAuthn / FIDO2). It allows users to sign up and log in using passkeys on iOS, Android, and Web.

    Key features include:

    • Passkey Authentication: Sign up and login using Corbado as the relying party server.
    • Conditional UI: Support for login via conditional UI.
    • Email OTP Fallback: Provides email-based One-Time Passwords (OTP) when passkeys are unavailable (e.g., when a user is on a device without their registered passkeys).
    • Session Management: Handles keeping users logged in across app restarts and manages automatic token refreshing.

    Platform Support:

    • ✅ Android
    • ✅ iOS
    • ✅ Web
    • ❌ Linux, macOS, Windows

  6. What is Passkeys Doctor and how to use its results

    main

    Passkeys Doctor is an internal diagnostic tool used within the passkeys package to validate configurations and troubleshoot passkey flows. It automatically checks for common setup errors across different platforms and provides descriptions and suggestions for fixes.

    To integrate diagnostic feedback into your application's UI, you can listen to a result Stream exported by the doctor. This stream emits the results of various checks and any exceptions encountered during the passkey lifecycle.

  7. How CorbadoAuthComponent works

    main

    The CorbadoAuthComponent is a stateful widget that acts as the orchestrator for the entire authentication UI. It accepts a corbadoAuth instance and a CorbadoScreens configuration object.

    Internally, it listens to a stream of authentication states (blocks) emitted by the CorbadoAuth instance. When a new block is emitted (e.g., a LoginInitBlock), the component uses the corresponding constructor provided in CorbadoScreens to instantiate and display the appropriate screen. This removes the need for manual routing between login, signup, and verification pages.

    CorbadoAuthComponent(
  corbadoAuth: corbadoAuth,
  components: CorbadoScreens(
    signupInit: SignupInitScreen.new,
    loginInit: LoginInitScreen.new,
    emailVerifyOtp: EmailVerifyOtpScreen.new,
    passkeyAppend: PasskeyAppendScreen.new,
    passkeyVerify: PasskeyVerifyScreen.new,
  ),
  loading: const Center(child: CircularProgressIndicator()),
)

  9. Use CorbadoAuthComponent for centralized authentication

    main
    The CorbadoAuthComponent is a new widget that integrates directly with CorbadoAuth via a stream. It automatically rebuilds with the appropriate screen (login, signup, passkey, OTP, etc.) based on the emitted Block data. This centralizes your authentication flow into a single widget and removes the need for manual page-by-page routing or state management.

  10. How passkeys work in Flutter

    main

    Passkey authentication involves three distinct parties:

    1. The User: The person interacting with your Flutter app.
    2. The Flutter App: The client application installed on a device with biometrics (e.g., Face ID, Touch ID).
    3. The Relying Party Server: A backend server where users' public keys are stored and validated.

    The Registration (Sign-up) Flow

    1. The user provides an email or username to the app.
    2. The app sends this to the Relying Party Server.
    3. The server responds with publicKeyCredentialCreationOptions.
    4. The app uses the passkeys package to interact with the device OS to create a passkey via biometrics.
    5. A private key is stored on the device, and the public key is sent back to the Relying Party Server for storage.

    The Authentication (Login) Flow

    1. The app requests a challenge from the Relying Party Server.
    2. The app asks the user for biometrics to access the private key.
    3. The device signs the challenge with the private key.
    4. The signed challenge is sent to the Relying Party Server, which validates it using the stored public key and returns a success message (e.g., a JWT).

  11. How Corbado Auth Firebase works

    main

    The system architecture consists of four components:

    1. Flutter App: Your application, which must use firebase_auth and include this package.
    2. Firebase Authentication: The backend managed via the Firebase console.
    3. Firebase Functions: Deployed via a Firebase extension, these act as a bridge. They call the Relying Party (Corbado) to validate passkeys and then use the Firebase Admin SDK to generate a custom Firebase token. This token allows the Flutter app to sign in to Firebase using the passkey.
    4. Relying Party Server (Corbado): Manages public keys, emits challenges, and validates passkey operations. Using Corbado removes the need for you to host your own relying party server.

  12. Passkeys Doctor validation checks by platform

    main

    The Passkeys Doctor performs specific validation checks depending on the platform being used:

    RPID Validation

    • Ensures the Relying Party ID (RPID) is properly formatted.
    • Verifies that the RPID is a valid domain.

    iOS-specific Checks

    • Fetches the AASA (Apple App Site Association) file from the Relying Party.
    • Verifies the presence of the app bundle in the AASA file.
    • Checks if biometrics are enabled when running on a simulator.

    Android-specific Checks

    • Fetches the assetlinks.json file from the Relying Party.
    • Retrieves the signing fingerprint from the app.
    • Verifies that both the app bundle and the correct fingerprint are present in the assetlinks.json file.

    Web-specific Checks

    • Ensures the RPID matches the current hostname.
    • Validates the existence of the passkeys JS script.