Claude Code, OpenClaw, ChatGPT Agent & Passkeys
ForgeRock Passkey Analysis
Here are this week’s topics that you don’t wanna miss out on!
🤖 AI Agents Authentication: Passkeys for agentic Logins
🔐 ForgeRock: Product Evolution and Passkey Capabilities
Can AI agents use passkeys? Short answer: No. Long answer: it's way more interesting.
Here's a question that keeps coming up as AI agents get smarter: if an agent can book flights, manage your calendar and call APIs on your behalf. Can it just log in with your passkey? The answer is a hard no and that's actually by design. Passkeys require a physical user gesture: a fingerprint, Face ID, a PIN. That's baked into the WebAuthn spec as a cryptographic proof of human presence. No software agent can fake that, and if it could, the entire security model would collapse.
But here's where it gets interesting: passkeys and AI agents aren't in conflict. They're actually a match. The secure pattern is delegation. You authenticate with your passkey, then hand the agent a scoped, temporary OAuth token to do its thing. For high-risk actions, the agent pauses and asks you to re-authenticate with your passkey before proceeding.
The article walks through real-world examples like GitHub MCP, agent-to-agent token exchange and even how verifiable credentials fit into the picture. Read more to see why passkeys might be the missing trust layer for the entire agentic web
ForgeRock’s wild ride: from open-source darling to enterprise passkeys
ForgeRock has had quite the journey. Born in 2010 as an open-source fork of Sun Microsystems' identity projects, it grew into a serious IAM player, went public and then got scooped up by Thoma Bravo for $2.3 billion in 2023, only to be merged straight into Ping Identity.
So where does that leave passkey support? The platform does have native WebAuthn nodes for registration and login, but: it's more of a low-level toolkit than a ready-to-go solution. Think 12-36 month implementation timelines and adoption rates that can hover around just 5-10% with the out-of-the-box flows.
Account recovery for passwordless users? Not really solved either. The default tools still revolve around password resets, which obviously don't help when there's no password. With engineering resources now focused on merging two massive platforms, don't expect turnkey passkey features anytime soon. Read more for the full technical deep-dive and what this means if you're running ForgeRock today.
More Passkey News
Microsoft Entra: Automatic activation of Passkey profiles in March
No Display? No Problem: Cross-Device Passkey Authentication for XR Devices
Join the Passkeys Community!
Our mission is to free the world from passwords to make the Internet a safer place - this can only be accomplished together.
Join our passkeys community to connect with other passkey enthusiasts, stay up-to-date, get implementation support and show your passkeys projects!