authentik asks
A normal WebAuthn challenge arrives through your browser.
← Blue Ripple Prime projects
04 · Open-source identity
BlueRipple Passkey.
Biometric login for authentik. Use your Linux laptop's fingerprint reader without reaching for a six-digit authenticator code.
Open source
Open source, by design.
BlueRipple Passkey is open source, released under the MIT licence. You can read the code, see how it handles sign-in, and use or improve it. It is how we practise transparency, one of our values, and how we give back to the community we build with.
Read the source on GitHub ↗One touch, standard protocol
You verify
A desktop prompt asks you to touch the fingerprint sensor.
The TPM signs
The device-bound key proves the login without exposing your biometric.
TPM-bound keys
The TPM performs signing; private key material is not stored in the app's credential metadata.
Local verification
Fingerprint matching stays with Linux fprintd. Authentik receives only a WebAuthn assertion.
Host allowlist
The authenticator refuses every relying party except the exact Authentik host you configure.
Install on Linux
Make this laptop
your authenticator.
Requires TPM 2.0, a fingerprint reader supported by fprintd, systemd, and an HTTPS authentik instance.
01 · Clone
git clone https://github.com/sqsergio1995/blueripple-passkey.gitcd blueripple-passkey
./install.sh --authentik-url https://auth.example.comThen import the included authentik blueprint and enroll the new security key. Keep recovery codes until a private-window login succeeds.
Experimental: not independently audited or FIDO certified. Fingerprint verification is an application-level gate, not a TPM policy. Read the full disclaimer ↗
MIT LICENSED · INDEPENDENT COMMUNITY PROJECT · EXPERIMENTAL