Passkey security review cost: $2,400, own that PDF

Passkey security review cost is $2,400 once for one app whose users sign in with a passkey. $1,200 starts the work. The report is due 48 hours after that test login works. You own the PDF. There is no subscription.

Short answer: Passkey security review cost is $2,400 once, with $1,200 to start, for one app that signs people in with a passkey. I check the relying-party binding, whether user verification is actually required, and what session the API issues, then write the report 48 hours after access works. You own it. A password manager, a magic-link login, and a multi-week accredited pentest are different purchases. The offer is the web application security review.

What does a passkey security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying a password-manager seat, a monthly passkey add-on, or a certificate I do not hold.

A passkey is a discoverable WebAuthn credential. The OWASP Passkey Security Cheat Sheet puts it plainly: the authenticator keeps the private key, the relying party stores the public key, and the credential is scoped to a relying party identifier. That binding is phishing resistance only when your server checks it.

What you are buying	2026 price	What you actually get
This review	$2,400 once, $1,200 to start	One app, the passkey ceremony and the session it creates, report in 48 hours, one retest
HackNow web app, including its API	From $5,000	Wider app, retest included, attestation letter included
Pentestica web application or API	$2,500–$5,500	A manual test of the app or the API, not a 48-hour passkey pass
Small SaaS web app, market	$3,000–$8,000	About 3–5 days, one role, the whole app rather than the ceremony

HackNow’s pricing page, reviewed October 2026, starts a web application, including its own API, at $5,000, with a retest and an attestation letter. Pentestica’s benchmark lists a web application or API at $2,500–$5,500. SaaS Security’s 2026 guide puts a small SaaS web app, about 20 pages and one role, at $3,000–$8,000 over 3–5 days.

Two passes of this review, a year apart, are $4,800 over 24 months. Three are $7,200 over 36 months. You are not renting the PDF.

The same $2,400 is on pricing. If the product is a SaaS app with customer accounts, the industry page is website security review for SaaS. An email-link pass is a different writeup: magic link security review cost.

What does that $2,400 check on a passkey?#

I register a passkey on a test account you give me, sign in once, and record what the API accepts. The pass covers the live ceremony and the session those pages already create. I do not ship a recipe for forging an assertion.

OWASP treats user presence and user verification as different flags. A tap is not a PIN or a biometric. The server has to ask for verification and check the flag that comes back.

I record, in plain findings:

• Whether the relying party identifier and the origin match the allowlist you think you set.
• Whether user verification is required, or a presence tap is enough.
• Whether a new passkey can be added from a long-lived session with no fresh sign-in.
• Whether email or SMS recovery still opens the account when the passkey fails.
• Whether a synced passkey and a device-bound key are treated as the same thing.

NIST SP 800-63B-4 says syncable authenticators shall not be used at Authentication Assurance Level 3, because that level requires a non-exportable private key. If your questionnaire says AAL3 and your users sync the passkey through a cloud account, the finding is that mismatch. I do not issue the letter.

OWASP also says a signature counter is not a universal clone detector. Some authenticators never implement one, and a synced credential is not strictly monotonic. I note the policy you actually run. I do not tell you to lock out every user whose counter stays at zero.

The document shape is the sample pentest report. No client names. No exploit steps.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a vendor product audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

This is not a magic-link review. If login is an email URL, that is the magic-link post, not this one. A refresh token that mints new access tokens is a later pass: refresh token security review cost. Same price, different ceremony.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not test a passkey.

How does the review run from the ceremony to the PDF?#

You authorize one URL, I use the test account you send, and the clock starts when I can register a passkey. Your API decides whether it believes the assertion. The PDF is what you keep. I do not patch production inside this price.

Step	What happens
Trigger	Users already sign in with a passkey, or a buyer asked whether that login is the whole control
Action	I register a passkey, sign in once, and compare that session to the checks the login page already calls
System of record	The app’s credential store, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization and one test user that can create a passkey. Say whether synced passkeys are in scope or only a hardware key. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if nobody can sign in with a passkey today, or if I cannot legally open the app. A pass with no ceremony is a normal login skim. Ship the passkey, then book the review.

Wait if the flow is still a ticket. Hire the firm that holds CREST if the questionnaire requires that name. If the only question is the email link, or the refresh token, buy that pass instead of this one twice. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring the URL, one test user, and one sentence on whether user verification is required. I can start without a tour of your password manager. I cannot start without a login that behaves like production.

Before you pay, write the list:

• The relying party identifier and the origins that may complete the ceremony.
• Whether a presence tap is enough, or user verification is required.
• Whether a synced passkey is allowed, or only a device-bound key.
• The recovery path that still works if the passkey is lost.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.