# Embracing passwordless authentication with Grab’s Passkey

[Grab](https://yomu.fyi/company/grab) · Ocean Nguyen · Dec 26, 2024

## Summary

Grab introduced Passkey to replace vulnerable traditional passwords and cumbersome multi-factor methods with a seamless, phishing-resistant alternative based on the FIDO standard. The architecture relies on an authenticator located on the user's device, a frontend client, and a backend storing only public keys and metadata. During registration and login, the frontend invokes WebAuthn APIs such as navigator.credentials.create and navigator.credentials.get using server-generated challenges to prevent replay attacks. Passkeys synchronize across ecosystems via Google Password Manager and Apple iCloud Keychain, allowing users to authorize logins with their device lock screen. This implementation improves user experience, eliminates the need to store secrets in backend databases, and cuts third-party communication costs associated with OTP delivery.

## Takeaways

- Passkey authentication eliminates the storage of secrets on Grab's backend servers, as private keys remain secured inside user authenticators.
- The login flow invokes navigator.credentials.get with server-generated challenges to defend against replay attacks while validating signatures against stored public keys.
- Implementing passkeys yields operational cost savings by reducing reliance on messaging platforms and third-party authentication services for one-time passcodes.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication)

[Read original post](https://engineering.grab.com/embracing-passwordless-authentication-with-passkey)