Tokyo passkey hackathon: pushing authentication beyond the login box
In June 2024, Google and the FIDO Alliance ran a passkey hackathon in Tokyo with a straightforward mission: give developers hands-on time with passkey technology and let them prototype real-world applications. Nine teams participated, with Google and FIDO Alliance staff providing direct guidance. The judges selected four standout projects, all of which took passkeys in notably different directions.
Grand winner: pkLock, an IoT door lock for short-term rentals
Keio University's SFC-RG pkLock team was the only group to tackle passkeys on IoT devices, and they came prepared with a 3D printer. Their device, pkLock, addresses a familiar pain point: handing over physical keys for Airbnb-style private lodging. The solution combines a QR display unit mounted outside the door with an unlocking mechanism inside, controlled through a web application for booking and access.
To open the door, a guest holds their phone under the outdoor unit, scans the displayed QR code, and completes passkey authentication via cross-device authentication. The team put considerable effort into an industrial design that hosts would want to install, and they demoed the system live by unlocking a miniature door built during the event. A one-time token in the QR code URL directs users to the authentication page; the team plans to add hybrid transport support so the device can trigger unlocking directly.
FIDO Award 1: SKKN, binding passkeys to verifiable credentials
SKKN, a privacy-focused research group from Waseda University, combined passkeys with verifiable credentials (VCs) and zero-knowledge proofs. Their work targets the self-sovereign and decentralized identity space, where a vulnerable wallet is a known risk: if a VC holder's wallet is compromised, an attacker can steal and present the credential. SKKN's implementation ties VCs to FIDO credentials so only the legitimate owner can present them, and restricts handling to wallets trusted by both the issuer and the verifier. Because passkeys support backup and recovery, users can restore their VCs and wallet even after losing a device.
FIDO Award 2: TOKYU ID, passkey-first sign-in with FedCM
Tokyu Corporation's URBAN HACKS team applied passkeys to TOKYU ID, the conglomerate's identity platform for daily services like train ticketing. User experience is top of mind here—delays from two-factor authentication could make a commuter miss a train. TOKYU ID adopted passkey sign-in in February 2024, and the hackathon let the team test a more ambitious design.
Their vision is full passkey registration during initial membership sign-up, coupled with account recovery built around social login via FedCM. In a deliberately passkey-centric twist, after recovering an account through social login, users are only permitted to register a new passkey. Their implementation notably integrated Google Sign-In in vanilla JavaScript using only FedCM—no GIS SDK.
Google Award: Nulab's eight-feature passkey push
Nulab, the software company behind Backlog, Cacoo, and Nulab Pass, is no stranger to WebAuthn—they've fully supported passkeys since October 2023. For the hackathon, they rolled out eight new features aimed at smoothing the path to passkey adoption:
- A dedicated passkeys card
- Introductory content about passkeys
- Rewards for passkey adopters
- Assistance for smooth account recovery
- A "Sign in with a passkey" button
- Mandatory 2FA for passkey adopters
- Password removal and passkey promotion when credentials leak
- Promotion of passkeys when a password is reset
The demo focused on account recovery guidance. When a user adds a passkey, the system suggests a second passkey from a different password manager if the first is device-bound; if the passkey is synced, it recommends removing the password entirely. Adoption rewards are also visible within the enterprise UI: a user's account icon starts circling upon adopting a device-bound passkey and blinks for a synced passkey, which motivates users to stand out on the company network.
Other notable projects
Several remaining teams addressed different friction points with passkey implementations:
- Nikkei ID (Nikkei): layered passkeys over OpenID Connect to cut user friction.
- Dentsu Soken (Dentsu Soken): merged passkeys with Google Sign-In to streamline onboarding.
- SST-Tech (Secure Sky Technology): investigated passkey emulation for security assessments.
- Ajitei Nekomaru (Keio University): added passkey authentication to an open-source LMS.
- MyLIXIL (LIXIL): implemented passkeys as an authentication method for their MyLIXIL service.
A full report on the event is available via the Tokyo passkeys hackathon report.
What the hackathon signals for passkey adoption
Patterns across the projects point to where passkey engineering is heading. There is clear movement toward protocols beyond simple web sign-in—verifiable credentials and zero-knowledge proofs came up repeatedly. User experience still dominates decision-making, with several teams designing recovery flows and sign-up journeys around a passkey-only principle. And the diversity of targets—IoT locks, identity platforms, enterprise suites—shows passkeys are being tested far outside the browser login form.
