Passkeys and sign-in

Sign in with a passkey, not a password

People sign in through Keycloak, with a password, a passkey or their organization's provider. A passkey is made on your device and checked by Keycloak, and Branchscope never sees it. The CLI gets its token through the browser, tokens and SSH keys carry their own limits, and agents sign in on their own.

RegisterRead the docs

Signing in

Keycloak signs you in, Branchscope keeps a session

You sign in on Keycloak's sign-in page, in Branchscope's look and your language. Only the control plane talks to Keycloak: the web app keeps an opaque session in an httpOnly cookie for 30 days and never sees Keycloak's tokens. Signing out ends the Keycloak session too. Someone disabled or deleted in Keycloak loses every session, token and SSH key at the next user sync, every two minutes by default.

sso.branchscope.example › branchscope

Sign in to Branchscope

Username or email

alice

Select your passkey

aliceMacBook

Password

Sign inSign in with a passkey

Passkeys

Your fingerprint, face or PIN instead of a password

Add a passkey under Settings → Privacy and security. Keycloak may ask you to sign in again, asks you to name it, and your device makes it. Every sign-in with it needs your fingerprint, face or PIN, and the sign-in page offers it under the username field. Keycloak keeps its public half and checks each sign-in; Branchscope never sees it. Settings shows when each passkey was added and last used, and renames it (1 to 100 characters) or removes it. Tokens, agents and apps can't list or change passkeys.

alice › Privacy and security

Passkeys

Add a passkey
NameAddedLast used
Work phone · Rename5 weeks ago4 days agoRemove
MacBook · Rename3 months ago2 hours agoRemove

Passwordless

A passkey takes the password's place

A passkey isn't a second step after your password: it signs you in on its own, and a password you have still works. The last way you sign in can't be removed. With no password and no linked identity, your only passkey stays until you add another, and Settings suggests a backup on a second device. Lose them all and you sign in with your password or your organization's provider, or a site administrator helps in Keycloak's admin console. Or choose Forgot Password? on the sign-in page, and Keycloak emails you a link to set a new password.

alice › Privacy and security

This is how you sign in: set a password, add another passkey or link an identity first.

Passkeys

Add a backup passkey

MacBookRemove

This passkey is the only way you sign in. Add a second one, on another device, in case you lose this one.

CLI and credentials

The browser approves, the credential keeps its limits

bscope auth login opens the web app; you approve, and the CLI gets a personal token named after the computer. The handoff is a one-time code that works for 2 minutes, with its state, so the token never appears in a URL. Tokens and SSH keys can be read-only, limited to some repositories and set to expire. Only a signed-in person makes them, in the web app, so bscope token create opens the browser too, and a token is shown once and kept only as a hash. Agents don't use them: bscope agent login signs an agent in on its own, and its access tokens last an hour.

~
$ bscope auth login
Opening https://branchscope.example/cli/login?host=alice-laptop&port=53817&state=… in your browser to approve.
If it doesn't open, visit that URL yourself.
Logged in to https://branchscope.example as alice.
$ bscope token create --name deploy-script --read-only --repo acme/invoices --expires-in-days 30
Opening https://branchscope.example/cli/login?expires=30&host=alice-laptop&name=deploy-script&port=53911&purpose=token&repos=acme%2Finvoices&scope=read&state=… in your browser to approve.
bsc_pat_Q3vX…
This is the only time the token is shown.
$ bscope agent token --name claude-code
bsc_oat_9fKd…

On the record

Every passkey change in your audit log

Each passkey added, renamed or removed is in your own audit log once, whether you did it in Settings or someone did it in Keycloak, and the entry says which. Branchscope checks with Keycloak when you sign in, when you open the list, and at each user sync. If Keycloak can't be reached, nothing is listed, changed or recorded, and Settings says so instead of showing no passkeys.

alice › Audit log
  • alicerenamed the passkey Phone to Work phonepasskey.renamed
  • alicethe passkey Security key was removed in Keycloakpasskey.removed
  • alicethe passkey Phone was added in Keycloakpasskey.added
  • aliceadded the passkey MacBookpasskey.added

Add your first passkey

Open Settings → Privacy and security, choose Add a passkey, and sign in with it next time.

Register