turnkey_flutter_passkey_stamper 0.1.0

A Flutter package for passkey stamping functionalities.

Turnkey Flutter Passkey Stamper

This package contains a Flutter passkey stamper. It uses the Flutter passkeys package to do the heavy lifting. This stamper is meant to be used with Turnkey's http package.

Platform specific setup

iOS

To allow for passkey support on iOS, follow these steps.

Set up an associated domain (Apple's instructions)

You need to associate a domain with your application. Configure your webserver to have the following route:

https://<yourdomain>/.well-known/apple-app-site-association

copied to clipboard

This will be the path to a JSON object with your team id and bundle identifier.

{
  "applinks": {},
  "webcredentials": {
    "apps": ["XXXXXXXXXX.YYY.YYYYY.YYYYYYYYYYYYYY"]
  },
  "appclips": {}
}

copied to clipboard

In XCode under Signing & Capabilities add a new Associated Domains capability:

webcredentials:YOURDOMAIN

copied to clipboard

Android

Passkey support configuration for Android is as follows.

Set up Digital Asset Links (Google's instructions)

You need to associate a domain with your application. Configure your webserver to have the following route:

https://<yourdomain>/.well-known/assetlinks.json

copied to clipboard

This will be the path to a JSON object with the following information. (Note: replace SHA_HEX_VALUE with the SHA256 fingerprints of your Android signing certificate):

[
  {
    "relation": ["delegate_permission/common.get_login_creds"],
    "target": {
      "namespace": "android_app",
      "package_name": "com.example",
      "sha256_cert_fingerprints": ["SHA_HEX_VALUE"]
    }
  }
]

copied to clipboard

Usage

Create a new passkey

import 'package:turnkey_flutter_passkey_stamper/passkey_stamper.dart';

// Returns authenticator params that can be used with sub-org creation, user creation, etc.
final authenticatorParams = await createPasskey(PasskeyRegistrationConfig(
  authenticatorName: "End-User Passkey",
  rp: {
    'id': 'your.site.com',
    'name': 'Your App',
  },
  user: {
    // This ID isn't visible to users
    'id': DateTime.now().millisecondsSinceEpoch.toString(),
    // ...but name and display names are. This is what's shown in the passkey prompt
    'name': 'Some Name',
    // displayName should be the same as "name"
    'displayName': 'Some Name',
  },
));

copied to clipboard

Use an existing passkey

import 'package:turnkey_flutter_passkey_stamper/passkey_stamper.dart';
import 'package:turnkey_http/turnkey_http.dart';

final stamper = PasskeyStamper(PasskeyStamperConfig(rpId: 'your.site.com'));

// The Turnkey client uses the passed in stamper to produce signed requests
// and sends them to Turnkey
final client = TurnkeyClient(
  config: THttpConfig(baseUrl: 'https://api.turnkey.com'),
  stamper: stamper,
);

// Now you can make authenticated requests!
final data = await client.getWhoami(
  input: TGetWhoamiRequest(organizationId: '<Your organization id>'),
);

copied to clipboard

Demo app

Head over to this repository for a fully functional Flutter demo app!