Template pack
Everything in the $49 ZIP
Six items, each opened below with what it does and a real excerpt. The archive ships when checkout opens; this page is the spec it is built to.
The interest form is saved only in this browser
Nothing is sent to a server, no order is created and nothing is charged. Checkout opens later through Creem.
Archive layout
Open any item to see its purpose and a short excerpt. Code blocks have a copy button.
templates/nextjs-webauthn/Runnable Next.js App Router example
A small Next.js app you can run locally and copy from: sign-up with a passkey, sign-in, a settings page to list and revoke keys, and recovery codes. Server code uses @simplewebauthn/server; the browser side uses @simplewebauthn/browser.
- Route handlers for registration and authentication options + verification
- Challenge store with expiry, plus a session cookie after login
- Settings screen: list, rename, revoke passkeys
- Recovery codes: generate, hash, show once, redeem
import { generateRegistrationOptions } from "@simplewebauthn/server";
const options = await generateRegistrationOptions({
rpName: "Acme",
rpID: process.env.RP_ID!, // e.g. app.acme.com
userName: user.email,
excludeCredentials: user.passkeys.map((k) => ({ id: k.credentialId })),
authenticatorSelection: { residentKey: "preferred", userVerification: "preferred" },
});templates/supabase-migration/Password → passkey migration for Supabase
Steps for adding passkeys next to existing Supabase password accounts, so current users keep working while they enrol a passkey.
- Create the passkeys table with row-level security
- Offer "add a passkey" after a normal password login
- Let enrolled users sign in with a passkey first, password as fallback
- Optionally hide the password field once a user has two passkeys
create table public.passkeys (
id text primary key, -- credential ID, base64url
user_id uuid not null references auth.users (id) on delete cascade,
public_key bytea not null,
counter bigint not null default 0,
transports text[],
created_at timestamptz not null default now()
);
alter table public.passkeys enable row level security;templates/clerk-alternative-notes.mdKeep Clerk or move out: a decision note
If you already use Clerk, this note helps you decide whether to keep it and turn on its passkey option, or move auth into your own database.
Keep Clerk if
- its built-in passkey option covers what you need
- you rely on its user and organisation management UI
Move out if
- you must own the credential table and session format
- pricing per active user no longer fits your plan
## Decision in one question
Do you need to own the credential table and the session format?
- No → keep Clerk, turn on its passkey option, stop here.
- Yes → follow supabase-migration/ or the custom-JWT path.
We do not reverse-engineer or bypass Clerk.CHECKLIST.md30 go-live checks
Thirty checks to run before you turn passkeys on in production, grouped by config, ceremony, storage, UX, recovery and operations.
- [ ] 1. RP ID is the registrable domain users sign in on
- [ ] 2. Expected origin lists every production origin explicitly, no wildcards
- [ ] 6. Challenges are random, single-use and expire within 5 minutes
- [ ] 14. Signature counter is compared on each login
- [ ] 18. Users can rename and revoke a passkey
- [ ] 22. Recovery codes are generated with a CSPRNG and stored hashedTEST_PLAN.mdBrowser and device test matrix
A matrix of browsers, operating systems and flows to test by hand, with a column for passkey autofill (conditional UI).
| Environment | Register | Sign in | Autofill |
|---|---|---|---|
| Chrome · Windows 11 | □ | □ | □ |
| Safari · macOS | □ | □ | □ |
| Safari · iOS | □ | □ | □ |
| Chrome · Android | □ | □ | □ |
| Firefox · desktop | □ | □ | □ |
| Phone as key (QR, cross-device) | □ | □ | — |
The boxes are empty for you to tick. The $499 plan includes a filled-in record for your app.
LICENSECommercial use terms
A short commercial licence: use the code in your own products and client work, but do not resell the template itself.
Compatibility
What the example targets. Other stacks can follow the same steps, but these are the versions the code is written for.
| Part | Target version | Covered by |
|---|---|---|
| Next.js (App Router) | 14.2+ · 15 | Runnable example |
| Node.js | 20 LTS+ | Example + CI script |
| @simplewebauthn/server · browser | v13 | Runnable example |
| Supabase (Postgres + Auth) | supabase-js v2 | Migration SQL + steps |
| Custom JWT session | jose v5 | Notes + snippet |
| Clerk | — | Decision notes only |
Targets, not certifications. Versions will be re-checked and noted in the changelog when the ZIP ships.
License in plain words
You can
- Use the code in any number of your own products, commercial included
- Use it in client projects you build and hand over
- Modify it freely; no attribution needed in your product
You cannot
- Resell, sublicense or share the template itself
- Ship it inside a boilerplate, starter kit or course
- Publish the unmodified source in a public repo
Summary only. The LICENSE file in the ZIP is the binding text.
Delivery and refunds
How you get it
After paying through Creem you get a download link for the ZIP and a welcome email with quick start, environment variables and five common errors.
Refunds
Digital goods: refunded only if the ZIP fails to download within 24 hours and we cannot fix it. Upgrading to an install is always possible.
FAQ
Do I need Next.js?
No. The example is Next.js, but the checklist, test plan and Supabase steps apply to any web stack that can run a WebAuthn server library.
Does it work with the Pages Router?
The example uses the App Router. The server logic is plain functions, so moving it into API routes is a small change.
Will the template be updated?
Every change is listed in the changelog below with its date.
Where does the interest form go?
Nowhere. It is saved in this browser's localStorage only. Nothing is sent to us, and it is not an order.
Is this a security audit?
No. PassGate is implementation help and a template. It does not certify your product. Responsibility boundaries are written into the order.
Changelog
- Template page rebuilt
Each file now opens with its purpose and an excerpt, plus a compatibility table, license summary, FAQ, free CHECKLIST.md sample and 10 languages.
- PassGate site launched
Landing page and template page in Simplified Chinese and English. Checkout shown as a placeholder.
- Nextv0.1 ZIP and Creem checkout
The archive and payment links go live together. Not dated yet.