\n<\/p>\n
Posted by Niharika Arora \u2013 Developer Relations Engineer<\/em><\/p>\n From breaking news and entertainment to sports and politics, X<\/a> is a social media app that aims to help nearly 500 million users worldwide get the full story with all the live commentary. Recently, X developers revamped the Android app\u2019s login process so users never miss out on the conversations they\u2019re interested in. Using the Credential Manager API<\/a>, the team implemented new passkey<\/a> authentication for quicker, easier, and safer access to the app.<\/p>\n Today, traditional password-based authentication systems are less secure and more prone to cyber attacks<\/a>. Many users often choose easy-to-guess passwords, which bad actors can easily crack using brute force attacks. They also reuse the same passwords across multiple accounts, meaning if one password is hacked, all accounts are compromised.<\/p>\n Passkeys address the growing concern of account security from weak passwords and phishing attacks by eliminating the need for passwords entirely. The feature provides a safer, more seamless sign-in experience, freeing users from having to remember their usernames or passwords.<\/p>\n \u201cPasskeys are a simpler, more secure way to log in, replacing passwords with pins or biometric data like fingerprints or facial recognition,\u201d said Kylie McRoberts, head of safety at X. \u201cWe explored using passkeys to make signing in easier and safer for users, helping protect their accounts without the hassle of remembering passwords.\u201d<\/p>\n Since implementing passkeys, the X team has seen a substantial reduction in login times and metrics showing improved login flow. With passkeys, the app\u2019s successful login rate has doubled<\/b> compared to when it only relied on passwords. The team has also seen a decline in password reset requests from users who have enabled passkeys.<\/p>\n According to X developers, adopting passkeys even came with benefits beyond enhanced security and a simplified login experience, like lower costs and improved UX.<\/p>\n \u201cPasskeys allowed us to cut down on expenses related to SMS-based two-factor authentication because they offer strong, inherent authentication,\u201d said Kylie. \u201cAnd with the ease of login, users are more likely to engage with our platform since there\u2019s less friction to remember or reset passwords.\u201d<\/p>\n Passkeys rely on public-key cryptography to authenticate users and provide them with private keys. That means websites and apps can see and store the public key, but never the private key, which is encrypted and stored by the user\u2019s credential provider. As keys are unique and tied to the website or app, they cannot be phished, further enhancing their security.<\/p>\n <\/image><\/p>\n To integrate passkeys, X developers used Android\u2019s Credential Manager API, which made the process \u201cextremely smooth,\u201d according to Kylie. The API unifies Smart Lock, One Tap, and Google Sign-In into a single, streamlined workflow. This also allowed developers to remove hundreds of lines of code, boosting implementation and reducing maintenance overhead.<\/p>\n In the end, the migration to Credential Manager took X developers only two weeks to complete, followed by an additional two weeks to fully support passkeys. This was a \u201cvery fast migration\u201d and the team \u201cdidn\u2019t expect it to be that simple and straightforward,\u201d said Saurabh Arora, a staff engineer at X. Thanks to Credential Manager\u2019s simple, coroutine-powered API, the complexities of handling multiple authentication options were essentially removed, reducing code, the likelihood of bugs, and overall developer efforts.<\/p>\n X developers saw a significant improvement in developer velocity by integrating the Credential Manager API. With their shift to passkey adoption through Credential Manager API, they achieved an:<\/p>\n Using the Credential Manager API’s top-level methods, like createCredential<\/span> and getCredential<\/span>, simplified integration by removing custom logic complexities surrounding individual protocols. This uniform approach also meant X developers could use a single, consistent interface to handle various authentication types, such as passkeys, passwords, and federated sign-ins like Sign in with Google.<\/p>\n \u201cWith Credential Manager\u2019s simple API methods, we could retrieve passkeys, passwords, and federated tokens with a single call, cutting down on branching logic and making response handling cleaner,\u201d said Saurabh. \u201cUsing different API methods, like createCredential()<\/span> and getCredential()<\/span>, also simplified credential storage, letting us handle passwords and passkeys in one place.\u201d<\/p>\n X developers didn\u2019t face many challenges when adopting Sign in With Google using the Credential Manager API. Replacing X\u2019s previous Google Sign In, One Tap, and Smart Lock code with a simpler Credential Manager implementation meant developers no longer had to handle connection or disconnection statuses and activity results, reducing the margin of error.<\/p>\n <\/image><\/p>\n X’s integration of passkeys shows that achieving a more secure and user-friendly authentication experience can be achieved. By leveraging Credential Manager API, X developers simplified the integration process, reduced potential bugs, and improved both security and developer velocity\u2014all while sharpening the user experience.<\/p>\n \u201cOur advice for developers considering passkey integration would be to take advantage of the Credential Manager API,\u201d said Saurabh. \u201cIt really simplifies the process and reduces code you need to write and maintain, making implementation better for developers.\u201d<\/p>\n Looking ahead, X plans to further enhance the user experience by allowing sign-ups with passkeys alone and providing a dedicated passkey management screen.<\/p>\n Learn how to improve your app\u2019s login UX using passkeys<\/a> and the Credential Manager API<\/a>.<\/p>\n<\/div>\n![](\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiJBDCUgyNU3PZGJjKyeLncL_zp7FIivM5V5Y1sVvf5ftjwbnughwJszK4JvMgcNu_oIukprwUBSwMoEQlGz9Cq4CUNV1iy2OsHwnjLaLVoQ5U5juzQ4u-D9gDFJMwtlSGzEAuv7XdrQMPXzsAObarEhYOWXTicQFQdhQDx4lX3brOWMMCIn4vGOh89CgQ\/s1600\/image1.png\")
<\/a><\/p>\nSimplifying login with passkeys<\/h3>\n
<\/div>\nSeamless integration using the Credential Manager API<\/h3>\n
\n
\n
\n
\n
<\/div>\nA future with passkeys<\/h3>\n
Get started<\/h3>\n