---
title: "Passkeys: key concepts"
slug: "passkeys-key-concepts"
tags: ["S3 v9.5"]
updated: 2026-10-27T15:37:42Z
published: 2026-10-27T15:37:42Z
canonical: "docs.onespan.com/passkeys-key-concepts"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Passkeys: key concepts

Before you begin implementing passkeys on your application, you should first become familiar with the following key terms and concepts:

## Passkeys

**Passkeys** are FIDO-compliant authentication credentials that are tied to a user's account on a website or application. They allow users to access apps and websites the same way they would unlock their mobile devices — using biometrics (face, fingerprint), a PIN, or a pattern.

## FIDO

**FIDO (Fast Identity Online)** is the underlying standard that enables passkeys. It uses cryptographic key pairs — a public key that can be shared with websites or applications, and a private key that remains on the user's device — to make secure, passwordless authentication possible.

## JWT

JWTs stand for **JSON Web Tokens** which are used to securely transmit information between:

- your app
- your application server, and
- the DigipassONE Authenticate Cloud.

The information can be trusted and verified because each token is digitally signed.

![Flowchart illustrating FIDO registration and authentication process with JWT verification steps.](https://cdn.document360.io/038f59a7-abd0-4c14-9de7-3434d28b49fd/Images/Documentation/diagram-S3-passkey-integration.png?sv=2026-02-06&spr=https&st=2026-10-29T00%3A15%3A36Z&se=2026-10-29T01%3A15%3A36Z&sr=c&sp=r&sig=Op%2B%2FXDTrB1lGNml9DSIz3YiNItnXuq2tTFrj73%2F9Fg0%3D)

The diagram above shows how JWTs facilitate communication during the registration process:1

1. User sends an ID and password to the application server via an app or browser.
2. Application server returns a JWT.
3. A FIDO registration request (including a JWT) is sent to the DigipassONE Authenticate Cloud.
4. DigipassONE Authenticate Cloud. verifies the JWT and performs FIDO registration.
5. Once the user signs out and decides to login again, a FIDO authentication request is made to the DigipassONE Authenticate Cloud.
6. If authentication is successful, DigipassONE Authenticate Cloud generates and returns a JWT.
7. After the application server verifies the JWT, the user can now access additional app resources using the JWT.

## Tenant

A tenant is an instance of the DigipassONE Authenticate Cloud that is dedicated to your organization. To maintain security for all users, a unique JWT issuer and signing key is generated for each tenant.

## Tutorial App

Included with the DigipassONE App SDKs, the **Tutorial App** is a simple client application whose source code can be used to demonstrate passkey operations. It will help you learn how to:

- Configure your tenant.
- Allow an application to access your tenant.
- Build and deploy an application.
- Connect and test an application.

> 1 The authentication process has been omitted for simplicity.

Formerly Digipass S3 Cloud.

Formerly known as Digipass S3 App SDK. Includes SDKs for Android, iOS and web.