passkey

Also written: passkeys

A sign-in credential on the user's device that signs only for the real site, so a fake sign-in page has nothing it can capture and replay.

Where the book teaches it