Passkeys for Volt.io, Webhooks, Account Linking...

Dear Hanko Community —

First of all, a big thank you to all of you for your feedback of the past months, which has helped us tremendously in building the next-gen authentication infrastructure.

Here are the latest news and updates:

Customer Spotlight: Volt.io

Volt.io is developing the world's first global real-time payment network. By integrating Hanko’s passkey technology, Volt is improving their customer login as well as transaction authorization with cryptographic security to protect against phishing and provide strong customer authentication (SCA) for their PSD2 use cases.

‍

New Features

🪝 Webhooks

You can now create webhooks for your Hanko projects. Events to subscribe to are currently limited to user data, e.g. when a new user has been created or the primary email address was changed. More event types will be introduced in future releases. Learn more about webhooks in Hanko

🔗 Automatic Account Linking

Account linking is now activated by default for identity provider connections. This allows for existing accounts to be accessed with 3rd-party connections like Sign in with Google when using the same email address, and vice versa.

🔑 Improved Passkey Naming

When a new passkey is created, the suggested passkey name displayed in the passkey list of the user profile is generated by Hanko Backend. Previously, all passkey names looked like "Passkey-XXXXX", where "XXXXX" were the last characters of the random credential ID.

From now on, passkey name suggestions are based on the available information about the authenticator used to create the passkey, e.g. "iCloud Keychain", "Windows Hello" or "1Password", which greatly improves the usability of the passkey list in the user profile. This feature has been enabled for both Hanko and Passkey API projects.

▶️ Automatic project reactivation

Hanko Cloud projects that are in the free tier will be paused after 7 days of inactivity to preserve cloud resources. We wanted to make this as unobtrusive as possible, so we've added a respawner service to our production cluster that reactivates paused projects on the first request. Manual project reactivation on the Hanko Cloud Console dashboard can still be done, but should not be required anymore for your apps to not show an error when loading Hanko Elements anymore. Automatic project reactivation will only be active for new projects from today, but we'll update all projects gradually over the coming weeks.

Check our roadmap to see what's coming next.

Hanko is trending

Hanko was included in the list of the 50 trending open source startups by Runa Capital. We are grateful for the recognition and happy to be listed among so many other impressive companies. Can you spot us on the list and find out where we ranked?

New Passkey API guides

We’ve created new starter guides, explaining how to use Hanko Passkey API to integrate passkey authentication into different application stacks.

• Remix: Adding passkeys to a Remix app
• React: How to add a passkey login to your React app
• Node: Adding passkeys to a Node.js app
• Python & Flask: Integrate passkeys into your Python Flask app

You can find more guides and other content on authentication and passkeys in our blog.

🌐 Passkey ecosystem

• Vercel passkeys: The popular hosting platform Vercel announced full passkey support in January and has rolled out the login technology to all Vercel accounts over the past months. We think they did an awesome job and their implementation checks almost all boxes: A "Login with Passkey" button on the main sign in screen, the ability to create multiple passkeys, and a clean passkey list in the authentication settings to manage your passkeys. Only the passkey naming suggestions could be improved if they'd use the passkey AAGUIDs to resolve the passkey provider (see our new passkey naming feature listed above). A tiny bit more sophisticated, but really not necessary. Congrats to the team at Vercel, that's how it's done.
• ‍Attackers don’t hack in, they log in: IBM report finds cybercriminals are increasingly exploiting legitimate user identities. But as more and more organizations roll out WebAuthn-based authentication options, this will become so much harder for attackers.

‍

Securely yours,

The Hanko Team

‍

Don't miss out on our latest updates and discussions! Star us on GitHub and join our friendly community on Discord.

P.S.

‍