# Public-Private Key Authentication Register and authenticate users with passkeys and security keys, without using passwords. ## Discussion Eliminating passwords simplifies account creation and authentication for apps and websites. Additionally, it reduces risks that arise from the reuse of one password across multiple services, brute force attacks, and social engineering that bad actors use to obtain credential information. By implementing public-private authentication according to the [W3C Web Authentication](https://www.w3.org/TR/webauthn-2/) specification, your users no longer need to remember complicated passwords or rely on password managers. Instead of using a password, your macOS, iOS, or iPadOS device, known as the *authenticator*, generates a public-private key pair at account creation time, and sends the public key to the server. The server, known as the *relying party*, holds the public key for subsequent authentication, and uses *assertion* to challenge the authenticator to prove its identity is valid. There are two forms of public-private key authentication: *passkeys* and *security keys.* With passkeys, the device stores its public-private key pair in the user’s iCloud Keychain and syncs the keys across the user’s devices. Security keys store the public-private key pair on a physical medium, such as a security card or a USB key. ## Topics ### Fundamentals [Connecting to a service with passkeys](/documentation/AuthenticationServices/connecting-to-a-service-with-passkeys) Allow users to sign in to a service without typing a password. [Supporting passkeys](/documentation/AuthenticationServices/supporting-passkeys) Eliminate passwords for your users when they sign in to apps and websites. [Supporting Security Key Authentication Using Physical Keys](/documentation/AuthenticationServices/supporting-security-key-authentication-using-physical-keys) Allow users to authenticate using NFC, USB, and Lightning security keys in your app or service. ### Account registration [`ASAuthorizationPublicKeyCredentialRegistration`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialRegistration) An interface that credential registration requests adhere to. [`ASAuthorizationPlatformPublicKeyCredentialRegistration`](/documentation/AuthenticationServices/ASAuthorizationPlatformPublicKeyCredentialRegistration) A newly created platform credential that results from a credential registration request. [`ASAuthorizationSecurityKeyPublicKeyCredentialRegistration`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialRegistration) A newly created security key credential that results from a credential registration request. [`ASAuthorizationPublicKeyCredentialRegistrationRequest`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialRegistrationRequest) An interface that defines properties for a credential registration request. [`ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest`](/documentation/AuthenticationServices/ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest) The object for registering a new platform public key credential. [`ASAuthorizationSecurityKeyPublicKeyCredentialRegistrationRequest`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialRegistrationRequest) The object for registering a new security key credential. ### Account authentication [`ASAuthorizationPublicKeyCredentialAssertion`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialAssertion) An interface for establishing a public key-based assertion. [`ASAuthorizationPlatformPublicKeyCredentialAssertion`](/documentation/AuthenticationServices/ASAuthorizationPlatformPublicKeyCredentialAssertion) A class that represents the platform credential assertion type. [`ASAuthorizationSecurityKeyPublicKeyCredentialAssertion`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialAssertion) A class that represents the security key credential assertion type. [`ASAuthorizationPublicKeyCredentialAssertionRequest`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialAssertionRequest) An interface for requesting a public key-based credential assertion. [`ASAuthorizationPlatformPublicKeyCredentialAssertionRequest`](/documentation/AuthenticationServices/ASAuthorizationPlatformPublicKeyCredentialAssertionRequest) The concrete assertion request type for platform credentials. [`ASAuthorizationSecurityKeyPublicKeyCredentialAssertionRequest`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialAssertionRequest) A class that defines the assertion request type for security key credentials. ### Credential providers [`ASAuthorizationPlatformPublicKeyCredentialProvider`](/documentation/AuthenticationServices/ASAuthorizationPlatformPublicKeyCredentialProvider) A mechanism for providing public key credential requests to an app or service with iCloud Keychain. [`ASAuthorizationSecurityKeyPublicKeyCredentialProvider`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialProvider) A mechanism for providing public key credential requests to an app or service with a physical security key. ### Request configuration [`ASPublicKeyCredential`](/documentation/AuthenticationServices/ASPublicKeyCredential) An interface that defines the properties of the public key. [`ASAuthorizationPublicKeyCredentialParameters`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialParameters) An object that provides required parameters for the credential during registration. [`ASCOSEAlgorithmIdentifier`](/documentation/AuthenticationServices/ASCOSEAlgorithmIdentifier) An identifier for the algorithm that a credential’s key pair uses. [`ASCOSEEllipticCurveIdentifier`](/documentation/AuthenticationServices/ASCOSEEllipticCurveIdentifier) A structure that contains the elliptic curve identifier. [`ASAuthorizationPublicKeyCredentialAttestationKind`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialAttestationKind) A structure that defines the types of attestations a developer can request. [`ASAuthorizationPublicKeyCredentialResidentKeyPreference`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialResidentKeyPreference) A structure that specifies the relying party’s preference for resident key storage. [`ASAuthorizationPublicKeyCredentialUserVerificationPreference`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialUserVerificationPreference) A structure that defines the relying party’s user verification preference. [`ASAuthorizationPublicKeyCredentialDescriptor`](/documentation/AuthenticationServices/ASAuthorizationPublicKeyCredentialDescriptor) An interface that defines the credential identifier. [`ASAuthorizationPlatformPublicKeyCredentialDescriptor`](/documentation/AuthenticationServices/ASAuthorizationPlatformPublicKeyCredentialDescriptor) An object that holds the credential. [`ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor) An object that holds public key credential transport information. [`ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor.Transport`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor/Transport) A structure that defines the security key credential transport type. [`allSupported`](/documentation/AuthenticationServices/ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor/Transport/allSupported) An array of currently supported transport types. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)