TPM-bound keys
The TPM performs signing; private key material is not stored in the app's credential metadata.
← Blue Ripple Prime projectsBlueRipple
04 Open-source identity
BlueRipple
Passkey.
Biometric login for authentik. Use your Linux laptop's fingerprint reader without reaching for a six-digit authenticator code.
One touch, standard protocol
01
→authentik asks
A normal WebAuthn challenge arrives through your browser.
02
→You verify
A desktop prompt asks you to touch the fingerprint sensor.
03
The TPM signs
The device-bound key proves the login without exposing your biometric.
Local verification
Fingerprint matching stays with Linux fprintd. Authentik receives only a WebAuthn assertion.
Host allowlist
The authenticator refuses every relying party except the exact Authentik host you configure.
Install on Linux
Make this laptop
your authenticator.
Requires TPM 2.0, a fingerprint reader supported by fprintd, systemd, and an HTTPS authentik instance.
01 · Clone
git clone https://github.com/sqsergio1995/blueripple-passkey.git02 · Installcd blueripple-passkey
./install.sh --authentik-url https://auth.example.comThen import the included authentik blueprint and enroll the new security key. Keep recovery codes until a private-window login succeeds.
Experimental: not independently audited or FIDO certified. Fingerprint verification is an application-level gate, not a TPM policy. Read the full disclaimer ↗