# Agent Passkey

> Agent Passkey holds a person's passkeys and signs WebAuthn assertions with them, so an agent can sign in as that person without ever holding a secret. The key never leaves the service; an agent gets one signature, for one ceremony, on a site the person ticked — scoped, logged and revocable.

The remote MCP server is `https://app.solospace.dev/mcp` (Streamable HTTP, OAuth 2.1 with dynamic client registration, no API key). It has no browser: it signs bytes and the agent drives the page. Once connected, call the `passkey_howto` tool for the end-to-end procedure with your own connectors filled in.

## Docs

- [Documentation](https://app.solospace.dev/docs/md): What Agent Passkey is, and the six steps from “I hold a passkey for this site” to “I am signed in”.
- [Quickstart](https://app.solospace.dev/docs/md/quickstart): Connect an agent over OAuth, enrol a passkey in your own browser, write the operating notes.
- [MCP reference](https://app.solospace.dev/docs/md/mcp): Every tool on both servers, what each argument means, and what each status is asking you to do.
- [Failure modes](https://app.solospace.dev/docs/md/failures): The three refusals that look alike and mean opposite things, and why waiting_for_approval is a success.
- [Limits](https://app.solospace.dev/docs/md/limits): What this cannot do: enrolment, second-factor-only sites, unattended sign-in, custody.

## Key facts

- Enrolling a passkey is a human act, done in the person's own browser. No tool can do it, and there is no password fallback.
- `waiting_for_approval` is a successful pending state, not an error: wait `retryAfterMs`, then retry ONCE with byte-identical arguments. Changed arguments raise a second question and notify the same human twice.
- HTTP 403 `insufficient_scope` means re-authorize. HTTP 401 means refresh the token. A 200 with `isError: true` is a decision on the merits — stop.
- `clientDataJSON` must be passed through byte-for-byte from the page. Rebuilding it produces a signature the relying party rejects.
- UP/UV flags are never set unless a human really approved. `silent` mode signs UP=0/UV=0 honestly, and most sites reject that.