Almost every breach you read about starts the same way: a credential. A leaked password, a stolen API key, a private key copied off a laptop, a token pasted into the wrong chat. The attacker didn’t break the cryptography — they walked through the front door with a credential that was never really tied to anyone.
The root problem is that most secrets are bearer tokens: whoever holds one is treated as its owner.
The trouble with secrets
Passwords get phished. SSH keys get copied to a dozen laptops and never rotated. API tokens leak into git history, CI logs and error trackers. The common thread is that all of them are portable — a credential that can be moved is a credential that can be stolen.
If a secret can be copied, assume it eventually will be.
Passkeys for people
People sign in to Subnomic with a passkey. The private key is created on their device or security key and never leaves it; signing in means answering a challenge, not sending a secret. There is nothing to phish and nothing to paste. Accounts that still use a password can add TOTP two-factor with recovery codes.
# Bearer secret: copyable, replayable
client ──▶ "here is my password" ──▶ server
# Passkey: prove, don't reveal
server ──▶ challenge ──▶ device signs with a key it never exports
device ──▶ signature ──▶ server verifiesMachines can’t press a fingerprint reader
A CI job, an agent on a host or an AI client has no device to tap. It needs a credential it can present — so the question changes from “can this secret be copied?” to “how little does it unlock, and for how long?”
- Deploy tokens — a workspace API key with only the
sites.deployscope can publish and roll back a site, and cannot delete it. - Storage keys — scoped to buckets or a prefix and to read, write or delete, with an optional expiry.
- Registry robots — pull, push or delete on the repositories you name, with an optional expiry; only a hash of the secret is kept.
- Agent accesses — for Runa, workflows and MCP clients: the scopes and targets you pick, an expiry you must set, and never more than the person who created them can do.
Each of them shows its secret once, when it is created.
Revocation that works
Because every credential is its own record, revoking one is a single action that touches nothing else. A storage key stops working on its next request; a registry robot can no longer get new tokens, and the one it holds lasts minutes. There is no scramble to rotate a shared key across fifty machines.
Identity as the foundation
Everything else — terminals without open ports, least-privilege access, session recording — rests on knowing who or what is on the other end: a person with a passkey, or a credential that says exactly what it may touch.
Stop trusting strings
Authentication built on copyable secrets is authentication built on hope. Passkeys remove the secret wherever a person is present. Everywhere else, the next best thing is a credential too narrow and too short-lived to be worth stealing.
More in Security.