Integrate any generic Identity Provider (IdP) with Corbado Connect. Bring passkey authentication to your users without major system overhauls.
Try our demo application to see how Corbado Connect integrates passkeys into your application.
Corbado Connect allows you to seamlessly integrate passkey-first authentication into your existing Identity Provider (IdP) or authentication system. This approach allows you to offer your users a secure, convenient, and passwordless login experience while leveraging your current user management infrastructure. You can enhance your security and user experience without performing a complex migration or replacing your established authentication stack.
This guide provides a generic approach to integrating Corbado Connect with any authentication system, whether it’s:
The integration patterns described here can be adapted to work with virtually any authentication system that allows for custom authentication flows or external identity verification.
While we provide specific integration guides for popular authentication providers like Amazon Cognito, this guide serves as a foundation for integrating with any other authentication system.
Integrating Corbado Connect means layering passkey functionality on top of your existing system. Most enterprise clients already have a robust, often multi-step, sign-up process for account creation. Therefore, we recommend leaving your classic sign-up flow untouched and introducing passkeys after the user has successfully authenticated.
This post-login enrollment strategy ensures that a stable user identity (e.g. UUID) exists and an authenticated session is active — both are prerequisites for securely generating the tokens required for passkey operations. It also provides a natural path for your existing users to adopt passkeys. Once a user has created a passkey, they can use it to login without passwords.
For a deep dive into the data and best practices behind this recommendation, see our blog post on passkey creation best practices.
Here is a visual overview of the recommended user journey, outlining each step where you need to implement Corbado Connect using our UI components:
A key part of this flow is that after any successful login (both for passkey and non-passkey logins), the application should always redirect to a page hosting the CorbadoConnectAppend
component. This ensures every authenticated user is consistently offered the chance to enroll a passkey.
Rule: Always redirect to the append flow after login
This strategy is crucial for maximizing passkey adoption. The CorbadoConnectAppend
component’s built-in Passkey Intelligence is designed to handle multiple scenarios. For example, after a cross-device authentication (CDA or “hybrid login”), the user has successfully logged in, but their new device doesn’t have a passkey stored locally. Redirecting them to the append flow provides the perfect, low-friction opportunity to create one, improving their future login experience on that device.
This guide will walk you through the implementation of each necessary step.
In a typical integration scenario, the initial user sign-up is handled through your existing authentication system’s standard registration process. This could be through:
Once a user has successfully created an account and is logged in, Corbado Connect provides the ability to add a passkey to their account for future passwordless logins. This process is often called “passkey append” and represents the bridge between your existing user management system and Corbado’s passkey infrastructure.
This approach offers several advantages:
The complete user sign-up and passkey append flow is illustrated in detail in our User Sign-up Flow documentation. In the following sections, we’ll break down each component of the implementation and explore different integration patterns to suit your specific needs.
The user sign-up and passkey append process consists of a series of coordinated interactions between your application’s frontend and backend, your authentication system, and Corbado’s APIs. Here’s a high-level overview of the flow:
In the following sections, we will explain each step in detail.
The integration starts with the CorbadoConnectAppend
component, which is designed to be used immediately after a user has been authenticated through your existing system. The component guides users through creating (or “appending”) a passkey to their account, but only if they and their device meet the eligibility requirements.
Here’s an example integration:
For comprehensive information on configuration options, detailed styling choices, and customization using CSS variables and classes, please refer to the CorbadoConnectAppend component documentation.
When the component is initialized, it executes the function given in appendTokenProvider
to request a short-lived ConnectToken
from Corbado’s Backend API. This token authorizes the creation of a passkey for a specific and authenticated user (see ConnectToken documentation for more details).
Here’s an example implementation in your backend:
The endpoint performs several important steps:
The ConnectToken is short-lived and single-use. Always generate a new token for each passkey operation.
After a passkey is created, you may need to update settings in your authentication system to reflect this change. This could include:
This can be achieved using Corbado actions, which enable you to extensively customize Corbado Connect to suit your specific requirements.
The post-append
action is triggered after successful passkey creation. Here’s an example of how you might implement this action:
The exact implementation will depend on your authentication system’s API or SDK, but the general flow remains the same:
For more information about Corbado actions and how to implement them, see the Actions documentation.
Now that users can associate passkeys with their accounts, we can enable a truly passwordless login experience. The goal is to authenticate a user with their passkey using Corbado Connect and, upon successful verification, establish an authenticated session in your system.
The complete flow is illustrated in detail in our User Login Flow documentation.
The cornerstone of user login integration is signedPasskeyData
— a short-lived, single-use JSON Web Token (JWT) that confirms successful passkey authentication with Corbado Connect (option 1 & 2). This token acts as the link between Corbado Connect’s passkey authentication and your authentication system, which ultimately needs to establish a session.
There are several ways to integrate the passkey login flow with your authentication system:
signedPasskeyData
verification and session creation (refer to our dedicated Amazon Cognito integration guide, which follows this approach).signedPasskeyData
and establishes a session.In each option, it is necessary to create a session within your authentication system at the conclusion of the process. For simplicity, we demonstrate creating a server-side session and storing its session ID in a cookie. However, you have complete flexibility to implement sessions in any manner you prefer, such as using tokens implemented with a JWT and storing them in local storage.
We will now elaborate on each option in the following sections.
This option involves extending your existing authentication system through its plugin architecture or custom authentication method support. Many modern authentication systems provide ways to add new authentication methods or customize the authentication flow.
Here’s how the flow typically works:
This approach is ideal when:
The exact implementation details will depend on your authentication system’s extension capabilities. Some systems might require implementing specific interfaces or following certain patterns.
This option involves implementing a dedicated endpoint in your backend that handles passkey verification and session creation. This approach gives you full control over the authentication flow and is suitable when your authentication system doesn’t support extensions or when you need custom session handling.
Here’s how the flow typically works:
The implementation typically involves creating a new endpoint in your backend:
This approach is ideal when:
Remember to implement proper error handling and security measures in your endpoint, such as rate limiting and logging.
This option leverages Corbado’s action system to handle the authentication flow. Instead of implementing verification logic of signedPasskeyData
in your system, you can use a post-login
action to create and return a session. This approach minimizes the integration effort while maintaining security.
Here’s how the flow typically works:
The implementation involves creating a post-login
action:
This approach is ideal when:
The action environment provides secure access to your authentication system’s API. Make sure to configure the necessary credentials and permissions in your Corbado Connect project settings.
The integration starts with the CorbadoConnectLogin
component. The component takes care of the entire UI and logic for handling the passkey login and passing the result to our application logic to complete the login.
Here’s an example integration:
For comprehensive information on configuration options, detailed styling choices, and customization using CSS variables and classes, please refer to the CorbadoConnectLogin component documentation.
The implementation details for the onComplete
callback will be provided in the subsequent sections.
As we have integrated with the existing authentication system, session creation and storage are managed by it. Therefore, after a successful passkey login, we need to hand over to the existing authentication system to complete the login:
When using the custom endpoint approach, the onComplete
callback needs to send the signedPasskeyData
to your verification endpoint and redirect to the profile page:
When using a Corbado Action, the session ID is returned directly in the result
object, simplifying the frontend logic:
Providing users with a way to manage their passkeys is a critical part of the experience. The CorbadoConnectPasskeyList
component offers a complete, pre-built UI for users to list, add, and delete passkeys associated with their account.
This component should be placed in a secure, authenticated area of your application, such as a user profile or account settings page.
The CorbadoConnectPasskeyList
component requires a distinct ConnectToken
to perform each of its actions. Much like the enrollment flow, these tokens must be securely fetched from your backend to authorize each specific operation for the logged-in user.
Integrate the CorbadoConnectPasskeyList
component on a profile or settings page. The component will handle all the logic for displaying passkeys and managing user interactions:
For a detailed explanation of all available props and customization options, please see the CorbadoConnectPasskeyList component documentation.
The connectTokenProvider
function is the bridge to your backend. It’s responsible for fetching a ConnectToken
for the specific action (passkey-list
, passkey-append
, or passkey-delete
) the user wants to perform. You can use the same backend endpoint created for the enrollment step, as it’s already set up to handle different token types.
When a user opens the page, the component will call connectTokenProvider('passkey-list')
to get a token to display the existing passkeys. If they try to delete a passkey, it will call connectTokenProvider('passkey-delete')
, and so on. This ensures every action is explicitly authorized by your backend for the currently authenticated user.