Passwordless sign-in · Pilot phase
Pilot customers wanted – limited placesSign in with Face ID. Phishing hits a dead end.
Codeflix Passkey replaces passwords and SMS codes with an approval on the company iPhone. Unlike classic push apps, every request is cryptographically bound to the browser your employee is actually sitting at. A fake login page cannot even reach the iPhone.
$ login j.doe @ sso-your-company.cobrowser ✓ paired key signs the real addressserver checking browser signature and origin …server ⚠ origin sso-your-company.co ≠ sso.your-company.comserver ✗ no push sent · attempt loggediphone ✓ stays silent – nothing to tap by mistake
- 0 passwords
- no passwords, no SMS codes, nothing to intercept
- Face ID
- every approval biometric, key in the Secure Enclave
- Paired
- push only for the paired browser on the real domain
- Keycloak
- for every application behind your single sign-on
The problem
Push approvals are convenient – and an open door
Push-based two-factor sign-in caught on because it is simple: enter a username, tap “Yes” on the phone, done. Attackers exploit exactly that simplicity.
Anyone who knows a username can trigger real push requests – until someone approves out of habit or annoyance. And modern phishing kits sit invisibly between the employee and the real login page: the employee signs in as usual, the push is real, so is the approval – only the session ends up with the attacker.
With almost every push method the root cause is the same: the phone never learns where the employee actually is. It confirms whatever the server tells it.
- Push bombingAttackers flood the phone with requests until someone approves. A username is all it takes.
- Phishing proxiesA convincing lookalike domain relays the real sign-in. Codes, pushes and many MFA methods do not help here.
- Stolen sessionsIn the end it is not the password that matters but the signed-in session – and that is what gets taken over.
What makes Codeflix Passkey different
The push is just the doorbell
With Codeflix Passkey the push notification no longer carries any security responsibility. What counts is a cryptographic chain from the browser via the server to the iPhone – and it can be neither forged nor redirected.
Browser bindingCore
Each workplace browser is paired with the iPhone once and receives its own key that cannot be read out. On every sign-in the browser itself signs which address it really opened. Only if that signature checks out is a push sent at all – and the approval on the iPhone is valid for exactly that browser.
No push bombing
A foreign or unpaired browser cannot trigger a push. Your employees' phones only ring when they sign in themselves. Blocked attempts become a security signal instead of a risk.
Phishing-resistant – even against proxies
On a fake domain the browser signs the fake address. The server notices before the iPhone learns anything about it. There is no password and no code an attacker could capture and pass on.
Keys that never leave the device
The sign-in key is created in the iPhone's Secure Enclave and cannot be exported. Every approval requires Face ID. The server only stores public keys – a data leak there reveals nothing anyone could sign in with.
Only genuine, managed devices
Devices are set up centrally through your MDM (e.g. Jamf). At registration Apple confirms that the genuine app is running on a genuine iPhone. Self-registration by attackers or tampered devices is ruled out.
A clear approval instead of blind tapping
The approval on the iPhone shows which paired browser and which application requested the sign-in. Employees confirm a specific sign-in – not just any.
How it works
What a sign-in looks like
- 01
Set up once
Your IT rolls out the app via MDM and the iPhone registers with Face ID. Then the workplace browser is paired with the iPhone once via QR code.
- 02
Enter the username
The employee opens the login page as usual. In the background the browser signs the sign-in and the server checks browser and domain – only then does the push go out.
- 03
Confirm with Face ID
The request appears on the iPhone with browser and application. One glance and the sign-in is complete. No password, no code, in a few seconds.
Fit
Is it right for your company?
Codeflix Passkey pays off if …
- your employees work with company iPhones
- you want to get rid of passwords and SMS codes
- phishing is a real risk for you – or your cyber insurer asks about it
- you need to demonstrate phishing-resistant MFA, for example under NIS2
- you want to control your identities yourself rather than entrust them to a US provider
What you need
- Keycloak as single sign-on – existing or operated by us
- iPhones managed through an MDM (e.g. Jamf)
- Managed Chrome or Edge browsers at the workplaces
- Applications connected to Keycloak via OpenID Connect or SAML
Security & sovereignty
Strong sign-in that belongs to you
Codeflix Passkey builds on open standards: WebAuthn signatures, the same technology behind passkeys from Apple, Google and Microsoft. The difference: the keys are bound to managed company devices instead of being synced through a private cloud account – your IT stays in full control.
Sign-in runs on your own Keycloak – on your premises or in the Codeflix Private Cloud in Germany. No external identity provider sees who signs in when and where.
- No shared secretsNeither the server nor the iPhone holds anything an attacker could sign in with.
- Full traceabilityApprovals and blocked attempts end up in your Keycloak event log – ready for SIEM and audit.
- Central revocationLost a device or someone left the company? IT removes access centrally, without resetting passwords.
FAQ
Frequently asked questions
How is this different from regular passkeys?
Regular passkeys are usually synced through a private iCloud or Google account and only work on devices the user owns. Codeflix Passkey binds the key to the managed company iPhone and allows sign-in from any paired workplace browser – centrally controlled by your IT.
We already use an authenticator app with number matching. Isn't that enough?
Number matching stops push bombing because a victim without a login page sees no number. It does not help against phishing proxies: there the victim sees the number on the fake page and enters it correctly. Codeflix Passkey checks which domain the browser is really on – closing both gaps.
What happens if an iPhone is lost?
Without Face ID the key cannot be used, and without a paired browser no push is triggered at all. Your IT revokes the device centrally in Keycloak and sets up the replacement via MDM.
Do we have to use Keycloak?
Yes, Codeflix Passkey is an extension for Keycloak. If you do not have one yet, we set it up for you and, if you like, operate it in the Codeflix Private Cloud. Existing directories such as Active Directory can be connected.
Is Codeflix Passkey available for Android?
We currently support iPhones. If you use Android devices, talk to us – we are planning the feature set together with our pilot customers.
Pilot programme
Become a pilot customer
We are looking for a small number of companies to take Codeflix Passkey into production together with us. You get a guided rollout, a direct line to the developers and special terms for regular use.
Email info@codeflix.com, subject “Codeflix Passkey Pilot”