No passwords. No OTPs. One biometric tap.
MultiAuth replaces passwords and OTPs with FIDO2/WebAuthn passkeys — device-bound cryptographic credentials that eliminate phishing, replay and MFA fatigue by design.
Built on FIDO Alliance and W3C open standards. No proprietary protocols, no vendor lock-in — passkeys that work across Chrome, Safari, Firefox and Edge.
Passwords and OTPs were never built for this threat model.
OTPs and passwords are the most exploited attack surface in security.
Adversary-in-the-middle proxies capture SMS codes and session cookies in real time. SIM swaps hijack phone numbers. Credential stuffing weaponises every breached database. Legacy MFA — TOTP, SMS OTP, push notifications — is a losing battle.
Push notifications and codes overwhelm users into approving fraud.
Users tap-to-approve to make the noise stop. Help desks burn millions on password resets. Every code typed, every prompt approved, every shared secret stored — is a new opportunity for compromise. Authentication should not be a chore.
User chooses to register a passkey — no password required
The browser or OS prompts for the platform biometric (Face ID, Touch ID, Windows Hello, Android fingerprint). No shared secret. No password to remember.
One tap. No form fields.
Three factors of authentication — delivered in a single tap.
Possession (the device), inherence (biometric) and intent (origin-bound signature) — unified into one cryptographic gesture.
Device-bound public-key credentials generated in the platform secure enclave. The private key never leaves the device. No secrets traverse the web.
Face ID, Touch ID, Windows Hello, Android fingerprint as the user verification gesture. Biometric data never leaves the device — never transmitted, never stored remotely.
Passkeys are cryptographically scoped to the origin domain. A passkey for app.example.com cannot be used at attacker.com — phishing eliminated at the protocol level.
Corporate SSO — signed in under six seconds.
- 00:00Employee opens the corporate SSO portalNo password field. The portal asks for the work email only.
- 00:01Email entered, passkey detectedThe browser recognises a registered passkey for this RP ID and surfaces it via Conditional UI.
- 00:02Server issues a fresh challengeA cryptographically random nonce, bound to auth.sovio.id, sent to the authenticator.
- 00:03Biometric promptFace ID, Touch ID or Windows Hello — one gesture proves possession and presence.
- 00:04Device signs the challengePrivate key signs inside the Secure Enclave. The signature includes the origin hash and counter.
- 00:05Server verifies the assertionES256 verification against the stored public key. Origin check passes. Counter increments.
- 00:06Session activeEmployee lands on email, CRM and HR tools — no password typed, no OTP entered, no MFA fatigue.
Two factors. One survives a phishing campaign.
Built on FIDO Alliance, W3C and NIST — not proprietary protocols.
Every organisation that needs phishing-resistant, standards-based authentication.
For architects, security engineers and identity leads.
// 1. Server generates registration options
const options = {
challenge: base64url(server.generate()),
rp: { name: "Sovio", id: "auth.sovio.id" },
user: { id: base64url(user.id), name: user.email, displayName: user.name },
pubKeyCredParams: [{ type: "public-key", alg: -7 }], // ES256
authenticatorSelection: {
authenticatorAttachment: "platform",
residentKey: "required",
userVerification: "required"
},
timeout: 60000
};
// 2. Browser calls WebAuthn — biometric prompt fires
const credential = await navigator.credentials.create({ publicKey: options });
// 3. Server stores the public key — no password, no OTP seed
await fetch("/api/passkey/register", { method: "POST", body: JSON.stringify(credential) });clientData = parse(credential.response.clientDataJSON);
assert (clientData.challenge === server.challenge);
assert (rpIdHash(authData) === sha256("auth.sovio.id"));
assert (authData.flags.UP && authData.flags.UV);
ok = ES256.verify(pubKey, clientDataJSON + authData, signature);
assert (authData.counter > stored.counter); → SESSION ✓
The private key is generated inside — and never leaves — the device's Secure Enclave. There is no symmetric secret to phish, no seed to extract, no password to reset.
See Sovio MultiAuth
in your ecosystem.
Schedule a personalised demo to see FIDO2 passkeys, biometric verification and origin-bound authentication running end to end in your environment.