X improved login success price by 2x after adopting passkeys

Posted by Niharika Arora – Developer Relations Engineer

From breaking information and leisure to sports activities and politics, X is a social media app that goals to assist practically 500 million customers worldwide get the complete story with all of the stay commentary. Lately, X builders revamped the Android app’s login course of so customers by no means miss out on the conversations they’re taken with. Utilizing the Credential Supervisor API, the staff carried out new passkey authentication for faster, simpler, and safer entry to the app.

Simplifying login with passkeys

Right now, conventional password-based authentication methods are much less safe and extra vulnerable to cyber assaults. Many customers typically select easy-to-guess passwords, which unhealthy actors can simply crack utilizing brute drive assaults. In addition they reuse the identical passwords throughout a number of accounts, which means if one password is hacked, all accounts are compromised.

Passkeys handle the rising concern of account safety from weak passwords and phishing assaults by eliminating the necessity for passwords completely. The function offers a safer, extra seamless sign-in expertise, liberating customers from having to recollect their usernames or passwords.

“Passkeys are an easier, safer solution to log in, changing passwords with pins or biometric knowledge like fingerprints or facial recognition,” mentioned Kylie McRoberts, head of security at X. “We explored utilizing passkeys to make signing in simpler and safer for customers, serving to shield their accounts with out the effort of remembering passwords.”

Since implementing passkeys, the X staff has seen a considerable discount in login instances and metrics exhibiting improved login stream. With passkeys, the app’s profitable login price has doubled in comparison with when it solely relied on passwords. The staff has additionally seen a decline in password reset requests from customers who’ve enabled passkeys.

In accordance with X builders, adopting passkeys even got here with advantages past enhanced safety and a simplified login expertise, like decrease prices and improved UX.

“Passkeys allowed us to chop down on bills associated to SMS-based two-factor authentication as a result of they provide sturdy, inherent authentication,” mentioned Kylie. “And with the benefit of login, customers usually tend to have interaction with our platform since there’s much less friction to recollect or reset passwords.”

Passkeys depend on public-key cryptography to authenticate customers and supply them with non-public keys. Meaning web sites and apps can see and retailer the general public key, however by no means the non-public key, which is encrypted and saved by the person’s credential supplier. As keys are distinctive and tied to the web site or app, they can’t be phished, additional enhancing their safety.

Seamless integration utilizing the Credential Supervisor API

To combine passkeys, X builders used Android’s Credential Supervisor API, which made the method “extraordinarily clean,” in accordance with Kylie. The API unifies Sensible Lock, One Faucet, and Google Signal-In right into a single, streamlined workflow. This additionally allowed builders to take away a whole lot of strains of code, boosting implementation and decreasing upkeep overhead.

In the long run, the migration to Credential Supervisor took X builders solely two weeks to finish, adopted by a further two weeks to completely help passkeys. This was a “very quick migration” and the staff “didn’t count on it to be that easy and simple,” mentioned Saurabh Arora, a workers engineer at X. Because of Credential Supervisor’s easy, coroutine-powered API, the complexities of dealing with a number of authentication choices have been primarily eliminated, decreasing code, the probability of bugs, and total developer efforts.

X builders noticed a major enchancment in developer velocity by integrating the Credential Supervisor API. With their shift to passkey adoption by Credential Supervisor API, they achieved an:

• 80% code discount within the authentication module
• 90% decision of legacy edge case bugs
• 85% lower in GIS, One Faucet, and Sensible Lock dealing with code

Utilizing the Credential Supervisor API’s top-level strategies, like createCredential and getCredential, simplified integration by eradicating customized logic complexities surrounding particular person protocols. This uniform method additionally meant X builders may use a single, constant interface to deal with varied authentication varieties, similar to passkeys, passwords, and federated sign-ins like Check in with Google.

“With Credential Supervisor’s easy API strategies, we may retrieve passkeys, passwords, and federated tokens with a single name, slicing down on branching logic and making response dealing with cleaner,” mentioned Saurabh. “Utilizing completely different API strategies, like createCredential() and getCredential(), additionally simplified credential storage, letting us deal with passwords and passkeys in a single place.”

X builders didn’t face many challenges when adopting Check in With Google utilizing the Credential Supervisor API. Changing X’s earlier Google Signal In, One Faucet, and Sensible Lock code with an easier Credential Supervisor implementation meant builders not needed to deal with connection or disconnection statuses and exercise outcomes, decreasing the margin of error.

A future with passkeys

X’s integration of passkeys reveals that reaching a safer and user-friendly authentication expertise could be achieved. By leveraging Credential Supervisor API, X builders simplified the mixing course of, diminished potential bugs, and improved each safety and developer velocity—all whereas sharpening the person expertise.

“Our recommendation for builders contemplating passkey integration could be to benefit from the Credential Supervisor API,” mentioned Saurabh. “It actually simplifies the method and reduces code you could write and preserve, making implementation higher for builders.”

Trying forward, X plans to additional improve the person expertise by permitting sign-ups with passkeys alone and offering a devoted passkey administration display screen.

Get began

Discover ways to enhance your app’s login UX utilizing passkeys and the Credential Supervisor API.