Identity verification and threat response for people and the AI agents acting for them.
Verify who someone is, prove it cryptographically, and respond the instant that trust breaks. Attestation, verifiable credentials, and passkeys behind one API.
A passkey proves who logged in. It says nothing about the SIM swapped an hour later, the number ported out, or the credential dumped in a breach overnight.
Account takeover happens in that window. PasskeyBridge ingests these signals and acts on them, and it verifies the person behind the request as well as the device holding the key.
Detect, decide, respond
See the signal
Ingest carrier and breach signals from your providers or a webhook.
Score it
Your playbook weighs the signal against policy. Hard signals are final.
Act in the same request
Revoke sessions, freeze credentials, suspend agents, or step up auth.
One API across the suite
Start with Attestation and expand across the suite without re-integrating. Every product uses the same API.
One POST request returns a decision
The quickstart takes this from a key to a first decision, and the API reference gives every field in the request and the response.
# Replace YOUR_API_KEY + YOUR_TENANT_ID with your dashboard values
curl -X POST https://api.passkeybridge.io/v1/shield-ingest \
-H "x-pb-api-key: YOUR_API_KEY" \
-H "x-pb-tenant-id: YOUR_TENANT_ID" \
-H "Content-Type: application/json" \
-d '{ "event_type": "sim_swap", "phone": "+14155551234" }'// Node 18+. Save as ingest.mjs, then run: node ingest.mjs
const res = await fetch("https://api.passkeybridge.io/v1/shield-ingest", {
method: "POST",
headers: {
"x-pb-api-key": process.env.PB_API_KEY,
"x-pb-tenant-id": process.env.PB_TENANT_ID,
"Content-Type": "application/json",
},
body: JSON.stringify({ event_type: "sim_swap", phone: "+14155551234" }),
});
const { result, actions_count } = await res.json();
console.log(result, actions_count);View each decision as it is made
Signals arrive, your playbook scores them, and actions fire in-request—the same decision your API returns, on one screen your team can watch. What each panel reads, and how to pull the same numbers into your own monitoring, is in observability.
You can verify these properties yourself
Two proofs, both required
Every credential carries a classical signature (ES256/ES384) and a detached post-quantum signature (ML-DSA-65/87). A break of one layer alone forges nothing.
Post-quantum signatures in production
Real NIST FIPS 204 ML-DSA signatures, checked against a known-answer gate on every deploy. 3,309-byte ML-DSA-65 signatures, independently verifiable.
No plaintext identifiers stored
Low-entropy identifiers stored only as keyed hashes; operational PII only as AES-256-GCM ciphertext. There is no plaintext to steal.
Free plan, then usage-based pricing
- Pillar I: Signal ingest + 1 playbook
- 1 signal source
- Single credential verification
- 90-day event retention
- Zero PII architecture
- Pillars I and II: signals + credentials
- Native VC engine + DID resolution
- Batch VP Token verification (≤20/req)
- StatusList2021 auto-refresh (ETag)
- 10 playbooks, 5 signal sources
- Everything in Pro
- Pillar III: hosted passkey relying party
- Shadow Identity Proxy (BLAST)
- Cached Trust Proofs (offline)
- Deterministic Cross-Reference
Add PasskeyBridge to your identity stack
Start free in minutes, or talk to us about the agentic and enterprise tiers.