Gravity Forms
+ Passkeys Premium

Give your Gravity Forms a passkey. The Gravity Forms Passkeys Premium Add-on lets a visitor create a passkey, sign in with one, or confirm a submission with one, using the same Face ID, fingerprint or security key they already use to unlock their phone or laptop. The passkey is checked on your own server with WebAuthn and FIDO2, so there is no outside service, no per-use fee and no account to open.

Drop a Passkey field onto any form and pick what it does: register a new passkey for the person who is filling in the form, sign an existing user in without a password, or ask for a passkey before the form is allowed to submit (a step-up check for a sensitive action). The browser runs the ceremony with the built-in authenticator; the server issues a single-use, time-boxed challenge, verifies the attestation or the signature, and refuses anything replayed or tampered with.

Every credential's public key and sign count are stored for the user, and a signature that does not move the sign count forward is rejected, so a cloned or replayed passkey is turned away. No password leaves the browser, nothing is sent to a third party, and the whole verifier is bundled in the add-on.

The browser runs the WebAuthn ceremony against a single-use challenge the server issues. The add-on verifies the attestation (for a new passkey) or the signature (for a sign-in or step-up) in bundled PHP, checks the relying-party hash, the origin, the challenge and the sign count, and only then lets the form submit. The credential public key and sign count are kept for the user. Nothing is sent to any outside service.