PasskeyBridge —

Engineering · 2026-03-07

Building an Identity Threat Playbook in Under 10 Minutes

By J. W. Bouckaert

Building an Identity Threat Playbook in Under 10 Minutes

The finished pipeline

In this tutorial, you'll configure a complete identity threat response pipeline:

  1. Create a PasskeyBridge account and get your API key
  2. Set up a webhook source for carrier signal ingest
  3. Build a playbook that responds to SIM-swap signals
  4. Test with a simulated signal and watch the response execute

By the end, you'll have a working playbook that detects a SIM swap and automatically revokes sessions, freezes credentials, and notifies your team, all in one pass, inside the request.

Step 1: Create your account

Sign up at passkeybridge.io/auth. The Starter plan is free forever with 100 signals per month, no credit card required. See our full platform overview for details on all plans.

Step 2: Create a webhook source

In your dashboard, navigate to the Settings tab and create a new webhook source. PasskeyBridge generates a unique ingest URL and signing secret for each source.

Point your carrier provider's webhook configuration at this URL. PasskeyBridge supports Vonage, Twilio, Sinch, and custom sources.

Step 3: Build your playbook

Navigate to the Playbooks tab and click "Create Playbook." Configure the following:

  • Name: SIM Swap Response
  • Trigger Type: Signal match
  • Signal Type: SIM swap
  • Actions (in order):
  1. Revoke sessions—invalidate all active sessions for the affected user
  2. Freeze passkey credentials—suspend all WebAuthn credentials (Pillar III)
  3. Suspend agent delegates—pause all scoped AI agent delegates issued by the user
  4. Webhook callback—POST the event to your application's incident handler
  5. Notify team—send an alert to your configured Slack channel or PagerDuty service

Each action executes in order. If an action fails, PasskeyBridge retries with exponential backoff (configurable max attempts).

Step 4: Test with a simulated signal

Use the PasskeyBridge API to send a test signal. The public ingest URL is https://api.passkeybridge.io/v1/shield-ingest. Authenticate with your tenant API key (x-pb-api-key) and, when a per-source signing secret is configured, sign the body with HMAC-SHA-256 and pass it via x-pb-signature:

PAYLOAD='{"event_type":"sim_swap","phone_hash":"a1b2c3d4...","carrier":"vonage","confidence":0.95,"timestamp":"2026-03-07T12:00:00Z"}'
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$SIGNING_SECRET" -hex | awk '{print $2}')

curl -X POST https://api.passkeybridge.io/v1/shield-ingest \\
  -H "Content-Type: application/json" \\
  -H "x-pb-tenant-id: $TENANT_ID" \\
  -H "x-pb-api-key: $PB_API_KEY" \\
  -H "x-pb-signature: $SIG" \\
  -d "$PAYLOAD"

Check the Events tab in your dashboard. You'll see the signal arrive, match your playbook, and execute all five actions, with per-action latency metrics.

Under the hood

The entire flow, from signal receipt to final action, runs inside a single request:

  1. API-key authentication and per-tenant rate limiting
  2. HMAC-SHA-256 payload verification (when a signing secret is configured)
  3. PII scrubbing (phone number normalized to SHA-256 hash)
  4. Signal normalization to one of the seven canonical types
  5. Playbook matching and ordered action execution
  6. Append-only audit logging

All of this runs with zero PII storage and full SOC 2 alignment.

Next steps

Get started free →

Start free · Test the API