Skip to content

Passkeys for Kotlin mobile apps

Build standards-first registration and sign-in for Android, iOS, and Compose Multiplatform, backed by authoritative verification on a JVM/Ktor server.

Mobile quickstart Run the complete sample

One shared Kotlin ceremony flow, platform-native passkey prompts, and a server boundary that remains responsible for challenges, origins, signatures, account binding, and replay prevention.

Start with mobile

Compose Multiplatform

Share orchestration and UI while keeping platform prompt lifecycles explicit. Start the Compose path →

Android

Integrate Credential Manager, Digital Asset Links, and provider-backed device tests. Read the Android guide →

iOS

Bridge Authentication Services, Associated Domains, and the presentation anchor. Read the iOS guide →

Mobile + backend

Run registration and authentication across the included app and Ktor service. Run the full stack →

The shortest production-shaped path

flowchart LR
    UI[Mobile UI] --> Flow[PasskeyFlow]
    Flow --> API[Ktor backend contract]
    API --> Service[Registration or authentication service]
    Service --> Store[(Credential and ceremony stores)]
    Flow --> Prompt[Android or iOS platform prompt]
    Prompt --> Flow
  1. Add the shared flow and transport artifacts, plus platform defaults.
  2. Construct the platform client at the host lifecycle boundary.
  3. Call the backend start endpoint, show the platform prompt, then send the response to the finish endpoint.
  4. Configure Android Digital Asset Links and iOS Associated Domains for the production RP ID.
  5. Verify both happy paths and failure paths on real provider-backed devices.

The latest stable coordinated release is v0.4.0. All published artifacts use the io.github.szijpeter group.

Project maturity

The API is evolving. Pin a release, read the changelog, and treat compatibility statements as release-specific.

Start where you are

You are building… Start here Then verify
Compose Multiplatform app Mobile quickstart Compose lifecycle
Android app Android integration Digital Asset Links and provider-backed device behavior
iOS app iOS integration Associated Domains, presentation anchor, and physical-device behavior
Mobile app plus backend Full sample Registration and authentication end to end
Existing JVM service Ktor quickstart Ceremony state, replay protection, and trusted origins
Custom protocol stack Artifact catalog Every replaced default and its security ownership