Passlock tenancies

Your Passlock cloud account includes multiple “tenancies”. Each tenancy is fully isolated. Tenancies are identified by a tenancyId. Each tenancy has its own data, including API Key(s).

The development tenancy

Each Passlock cloud account includes Development, Staging and Production tenancies. Staging and production have identical characteristics, but the development tenancy has some unique characteristics, which improve the developer experience.

Danger

Do not use your development tenancy for production data. If stable identifiers are enabled (see below) an attacker could substitute a passkey in your vault with their own.

Relaxed rpId configuration

Passkeys registered to a development tenancy will infer their rpId from the origin. e.g. If you create a passkey on http://localhost:3000 the rpId for that passkey will be inferred as localhost. In short, you don’t need to explicitly set your rpId in the Passlock console for development tenancies.

Stable credential IDs

During development you’ll likely register passkeys with the same username over and over again. By default, your browser will generate a new passkey each time. You’ll end up with multiple passkeys for the same username in both your vault and local passkey manager.

To prevent this happening, you need to use the excludeCredentials property, along with some checks in your backend code. You should do this in production.

To make the developer’s life easier we use stable credential IDs in development. This means a new passkey with the username jdoe@example.com will overwrite the existing jdoe@example.com passkey in both the backend vault, and device passkey manager. You can continue registering passkeys without accumulating duplicates.

Never use the development tenancy for production data !!!

Disabling stable IDs

When you’ve got the basics out of the way, go into your development tenancy settings and disable stable identifiers. Passkey registration will then behave as it does in staging and production.

Logging

Each tenancy features isolated logging. Logs can be viewewd in your console, and soon via the REST API. We create more log entries in the development tenancy:

1. Development - DEBUG INFO WARN ERROR
2. Staging - INFO WARN ERROR
3. Production - WARN ERROR