Updates · 2026-03-01

Introducing PasskeyBridge: Identity Security as a Service

By J. W. Bouckaert

The reason we built this

Every identity-aware application faces the same problem: what happens after a threat signal arrives? How do you verify that a user is who they claim to be once a SIM-swap, port-out, or device-compromise event lands in your queue? How do you bind identity to a person?

Traditional identity providers handle the front door—login, MFA, session issuance. They do not handle what happens at the side door. PasskeyBridge does. We answer the post-detection question with a unified Identity Threat Response as a Service (ITRaaS) platform built on three composable pillars.

The three pillars

Pillar I: Signal ingest & threat response

Post a signed JSON body to the shared ingest URL. When the body names a signal source you registered, the signature is checked against that source's secret. The playbook that matches the event type runs inside the same request. See how the request is shaped.

A carrier lookup asks one provider: Vonage Number Insight or Twilio Lookup on the hosted add-on, or your registered Vonage application or Sinch Number Lookup project. Compared in The Carrier Signal Landscape in 2026.
The event type is the string you send. A playbook matches that string.
Playbook actions run in parallel, each bounded by an eight-second timeout. A webhook callback is how your backend acts on users in your own identity provider. Build one.
A lookup that names one provider fails when that provider fails. There is no second provider on the same call. The pattern, and the lookup.

Pillar II: Verifiable credentials

Native W3C Verifiable Credentials 2.0 verification with optional BYOK for OpenID4VP and OIDC4VC presentation flows. Integrate with walt.id, Trinsic, or any conformant issuer. Users prove identity through cryptographic proofs without exposing personal data.

Selective disclosure via SD-JWT
Trusted issuer allowlists per tenant
Credential type filtering and presentation definition support
Scoped digital delegates for AI agents

Pillar III: Biometric binding

The hosted passkey relying party, on Enterprise, registers and authenticates WebAuthn / FIDO2 passkeys for your users. An opt-in policy can require user verification, an authenticator allowlist, and a hardware-bound credential. A SIM-swap signal does not disable those passkeys. The playbook action that freezes credentials invalidates cached proofs stored in PasskeyBridge.

Opt-in hardware-bound policy on the hosted relying party
The sync state of a credential is stored and shown
Hybrid post-quantum signing of proofs and cross-references. See Hybrid Signatures in Practice

Available today

All three pillars in production, exposed through one API surface
Real-time tenant dashboard with overview, events, keys, playbooks, identity, usage, posture, and a growing set of advanced security and observability tabs (CAEP, BLAST, cached proofs, runtime guard, agent trust, and more)
Scoped AI agent delegates for agentic workflows and A2A trust
Social recovery records guardian approvals against an M-of-N threshold. A confirmed guardian can start a recovery when the owner cannot sign in. Completing the request emails the owner a one-time sign-in link and does not remove their passkeys. The guardian model is the writeup.
SOC 2 readiness: evidence collected and under review, evidence-pack reusable across audit controls for identity APIs, built on a zero-PII architecture
Public, real-traffic API playground that runs the live /health probe from your own browser and reports the p50, p95 and p99 it observes

Pricing

PasskeyBridge ships three plans. Authoritative limits and Stripe-billed prices live on the pricing page; the figures here are accurate at publication.

Starter. Free. 100 signals/month, Pillar I, 1 playbook, 1 signal source, 90-day event retention, community support.
Pro. $99/mo. 10,000 signals/month, Pillars I and II, native VC engine, batch VP token verification (up to 20 per request), 10 playbooks, 5 signal sources, 90-day retention, 24h email SLA. 7-day free trial.
Enterprise. $499/mo. Everything in Pro, plus Pillar III (the hosted passkey relying party), agentic identity delegation, A2A trust, agent behavioral trust scoring, BLAST, cached offline trust proofs, 25 signal sources, and 1,000,000 signals/month included, then $0.04 per signal. 7-day free trial.

Pricing is usage-based. There is no per-seat fee. The pricing page and the FAQ are the figures Stripe bills.

Get started free →