Google Chrome | Passkey Skills Help AI Agents Build Secure Sign-In
Google Chrome introduced Modern Web Guidance passkey skills on July 15, 2026, giving AI coding agents a structured way to build passkey registration, authentication, management, and reauthentication for web applications. The preview can guide both frontend UI and backend logic, helping development teams apply current WebAuthn capabilities and passkey practices through their existing AI-assisted workflow.
Passkey Skills give coding agents a clearer implementation path
Modern Web Guidance embeds web platform expertise, compatibility information, and implementation practices into skills that an AI coding agent can use inside a project. For passkeys, this gives the agent more specific guidance about browser capabilities, interface behavior, credential operations, and server verification than a general request to create a passwordless sign-in page.
In an evaluation using the official demo application and Claude Code Opus 4.8, implementations created with the skills passed 80 of 91 checks and recorded no failures. Implementations without them passed 47 checks and failed 32. These results belong to the supplied demo and prompts, but they show how focused guidance can reduce missing or outdated implementation details.
Four workflows cover the passkey sign-in lifecycle
Registration covers the interface and server logic required to add a new passkey. Authentication supports direct sign-in controls and conditional mediation, allowing passkeys to appear through browser autofill suggestions when the experience and browser support that behavior.
Management gives users a place to view, rename, add, or delete their registered passkeys while keeping credential information synchronized. Reauthentication verifies an existing session again before sensitive actions, such as changing security settings or completing a financial transaction.
Modern APIs improve less visible authentication details
The skills include getClientCapabilities for feature detection, JSON serialization for encoded credential data, and error handling that can decide whether an error should be shown or quietly dismissed. These details can improve the sign-in experience without requiring the user to understand the underlying WebAuthn process.
Support for the Signal API helps synchronize credential information between a website's server and the passkey provider. Conditional create can offer a passkey to someone who recently signed in with a password, while the management interface can recognize provider names and icons through a community-maintained list.
Installation is simple, but server choices still matter
Developers can run npx modern-web-guidance@latest install from the project directory. The interactive wizard adds the required skill files so the coding agent can recognize the guidance. The skills can also be invoked directly when necessary, including with $modern-web-guidance in Codex.
Server-side implementation still requires attention because an agent may not automatically select the latest library version. The demo includes a simplewebauthn skill for JavaScript and TypeScript. Projects using other languages should combine the passkey guidance with a suitable passkey, FIDO2, or WebAuthn library and current documentation.
IMPORTANT: Modern Web Guidance and the passkey skills are in preview. They may require additional prompts or adjustments outside the demo project, and they do not cover every application-specific identity or notification workflow. Review all generated frontend and server code before production use.{alertWarning}
Daisuki's Take: What This Means for Web Designers
This release treats secure sign-in as a complete web experience rather than a single login button. Registration, autofill, passkey management, error states, and sensitive-action verification can now enter the same AI-assisted design and development workflow.
We would still review the generated interface and authentication logic as separate responsibilities. Clear labels and predictable feedback require design judgment, while server verification, current libraries, application-specific identity rules, and security testing require careful technical review.
The strongest role for Passkey Skills is to provide a more complete starting point. They can help small teams avoid overlooking modern capabilities, but production approval should remain with the people responsible for the website's user experience and security.
Sources and Recommended Links
- Implementing passkeys just got easier: Introducing the Modern Web Guidance passkey skills | Chrome for Developers Official Blog
- Modern Web Guidance | Chrome for Developers Official Documentation
- Passkey Agent Skills Demo | Google Chrome Labs Official GitHub Repository
