Why does a passkey sign the session, not the action?
WebAuthn and passkeys authenticate a user at login and produce a session credential. That credential then authorizes every downstream action with no further proof. The passkey signs the login challenge, not the specific action that moves money or grants a privilege. Yuthent adds a per-action signature bound to the action itself, so the proof travels with the act.
The distinction that matters
A login check records that someone authenticated earlier. A policy gate records that an action was allowed. A passkey is the strongest version of the login check, and it still operates at login.
Yuthent produces proof at the act: a hardware-bound, action-bound signature of a specific human, generated at the moment of execution, covering the exact parameters of the action.
What changes when the signature is bound to the action
- The proof covers the amount, the payee, and the action identifier, not just the fact that a session exists.
- A mutated parameter after approval breaks the signature, so what the verifier checks is what was approved.
- An attacker on a valid session, or an agent acting inside it, cannot produce the signature without the device and a fresh biometric.
- The evidence is verifiable after the fact, offline, against a published public key, which a session credential cannot offer.
Yuthent is Execution Authority Infrastructure. It runs alongside your passkey or passwordless login. Every engagement starts with a scoped first deployment.
Common questions
Do passkeys and WebAuthn verify the action?
No. A passkey signs the WebAuthn login challenge and establishes a session. After that, every action inside the session is authorized by the session credential, with no signature over the action itself. Passkeys are strong against credential phishing at login, and they do nothing at the action layer afterward.
Is Yuthent a replacement for passkeys?
No. Passkeys are the right tool for login. Yuthent is complementary. Keep the passkey for authentication, and add a per-action signature for sensitive operations so the proof is bound to the specific action, the amount, the payee, or the privilege being granted.
What about WebAuthn transaction confirmation or step-up?
OAuth step-up and transaction-confirmation patterns can require a fresh check, and they raise the bar. Yuthent supplies the per-action, action-bound evidence a step-up flow can demand: a hardware-bound signature over the canonical action, verifiable offline against a published public key.