> ## Documentation Index > Fetch the complete documentation index at: https://docs.monolex.ai/llms.txt > Use this file to discover all available pages before exploring further. # MonoPass > Create, store, verify, import, export, and use P-256 passkeys across standard WebAuthn, RP-client, Secure Enclave, and CDP automation flows. MonoPass is Monolex's passkey store and WebAuthn/FIDO2 client. It keeps service-scoped P-256 passkeys behind an envelope-encryption key, supports standard `navigator.credentials.create()` and `get()` JSON, can drive complete HTTP relying-party registration/login flows, and has explicit interop paths for Chrome DevTools virtual authenticators. The 0.4.0 dispatcher exposes **28 operational root commands** plus root help/version aliases. *Published contract: `monopass 0.4.0`, OpenCLIs build `2026-05-27-232315`. The executing binary, registry, and public CDN metadata agree on this release. The table below follows the exact 0.4.0 payload; generic token storage belongs to [OpenCLIs Vault](/ai-clis/openclis-vault), not to a `monopass cred` command in this release.* ## Quick Start ```bash theme={null} openclis install monopass monopass --version monopass init monopass status monopass webauthn-selftest ``` `--service ` selects a logical store, defaulting to `default`, and `--json` enables structured output where supported. Those two global flags are filtered wherever they appear in argv. A missing `--service` value silently falls back to `default`, so always supply and verify the intended service. ## Store and Integrity Commands | Command | What it does | Effect or boundary | | ------------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- | | `init` | Initializes the service database and envelope key. | Persistent cryptographic state write; do not initialize over an unknown existing store. | | `status` | Reports store/key health. | Read-only; an uninitialized service is reported in output but still exits 0. | | `stats` | Prints record counts and storage sizes. | Read-only; no private-key material. | | `services` | Lists initialized logical services. | Read-only inventory. | | `verify` | Checks every stored passkey's integrity. | Read-only cryptographic validation; non-zero on integrity failure. | | `whereis` | Prints database path and the legacy keyring service/account identifiers. | Read-only, but not proof of the active backend when OpenCLIs Vault is installed. | | `self-test` | Runs the complete store/encryption CRUD self-test. | Creates isolated test material; use `verify` for an existing production store. | | `dump-schema` | Prints the embedded database schema. | Developer/inspection command; no store mutation. | ## Passkey CRUD | Command | What it does | Important controls or risk | | ----------------------------------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | `list [--rp ]` | Lists passkey summaries, optionally for one relying party. | Read-only; private keys are omitted. | | `get ` | Shows passkey details for a relying party. | `--include-private` prints raw private key hex—treat output as a secret. | | `generate` | Creates a random P-256 passkey. | Requires both `--rp` and `--user-handle`; accepts `--user-name`, `--user-display-name`, and `--account-label`. | | `delete --rp --all` | Deletes every passkey for one relying party. | Destructive bulk operation. | | `delete --credential-id ` | Deletes one exact passkey. | Resolve the credential id before deleting. | | `delete ... --dry-run` | Lists rows that would match either delete shape. | Safe preview; use before `--all`. | | `update-sign-count --credential-id --count ` | Sets the WebAuthn signature counter. | Protocol-state mutation; use only when reconciling a known authenticator state. | ## Standard WebAuthn and RP Commands | Command | What it does | Inputs and outputs | | --------------------------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | `passkey-create` | Consumes an RP's standard creation-options JSON and emits standard credential JSON. | Read request from `--request ` or stdin; `--origin`; `--pin` or `--touchid`. | | `passkey-get` | Consumes standard request-options JSON and emits a standard assertion. | Same request/origin/user-verification controls. | | `webauthn-register ` | Builds a lower-level registration ceremony from flags. | `--challenge`, `--b64`, `--origin`, and user/RP metadata controls. | | `webauthn-authenticate ` | Signs a lower-level authentication challenge. | Requires `--challenge`; accepts `--origin`, `--b64`, and verification controls. | | `webauthn-selftest` | Performs in-process registration, authentication, and verification. | Crypto/format proof without an external RP. | | `set-pin --pin ` | Enables PIN-backed user verification and its UV bit. | Writes user-verification state; avoid exposing the PIN in history. | | `touchid-test` | Tests macOS Touch ID user verification. | macOS biometric prompt; platform-specific. | | `se-test` | Creates/tests a Secure Enclave key and biometric signature. | macOS hardware/biometric path. | | `webauthn-rp-register --rp-url --user ` | Drives a complete registration exchange with an HTTP RP. | Select `--pin` or `--touchid`; network and credential mutation. | | `webauthn-rp-login --rp-url --user ` | Drives a complete authentication exchange with an HTTP RP. | Network operation; same user-verification choices. | | `webauthn-rp-se-demo --rp-url --user ` | Demonstrates a Secure Enclave-backed RP passkey flow. | macOS-only hardware path plus network requests. | ## Assertion and Interop Commands | Command | What it does | Security boundary | | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | `assert --challenge ` | Produces a hand-rolled ES256 assertion from a raw stored P-256 key. | Designed for CDP virtual-authenticator interop; `--origin`, `--b64`, `--verify`. | | `verify-assertion ` | Verifies assertion JSON supplied on stdin. | Read-only verification against stored public material. | | `export [--output ]` | Exports **every** passkey in the selected service, including private keys. Without `--output`, JSON goes to stdout; on Unix the output file is set to mode 0600. | Secret-bearing output. The 0.4.0 handler does not implement an RP filter. | | `import [--replace]` | Reads passkey JSON from a required file path. | Persistent mutation; stdin is not accepted. `--replace` overwrites duplicates. Run `verify` afterward. | The installed 0.4.0 help advertises `export [--rp ]`, but the handler never parses that flag and exports the whole service. Do not use `--rp` as a confidentiality boundary. ## Parser and Exit Contract * Help is root-only: `monopass help`, `-h`, or `--help`. There is no command-specific help branch. `monopass init --help` still runs `init` because the handler ignores the extra token. * Version aliases are `version`, `-v`, and `--version`. * `passkey-create` and `passkey-get` always emit standard credential JSON even without the global `--json` flag. * Unknown/invalid arguments and invalid services exit 2; an uninitialized key exits 3; integrity failure exits 5; not-found exits 6; other errors exit 1. * Service names are 1–64 characters and accept Unicode alphanumerics, hyphen, and underscore. This differs from OpenCLIs Vault's ASCII-only validator. ## Storage and Key Ownership Each service owns `passkeys.db`, where each private P-256 PKCS#8 value is encrypted with AES-256-GCM and a per-row nonce. A service-specific 32-byte master key opens those rows. Backend selection is ordered: 1. `MONOPASS_FORCE_KEYCHAIN` forces the OS credential store. 2. `MONOPASS_FILE_STORAGE` forces a user file (intended for debug/CI). 3. If the stable OpenCLIs helper exists, MonoPass uses the Vault service `monopass-`. 4. Debug builds fall back to file storage; other builds use the OS credential store. On first Vault use, a legacy keyring master key is copied best-effort into the Vault while the keyring copy is kept as recovery material. `init` and `whereis` still print the legacy `ai.monolex.monopass.` identifier even when the Vault is the active backend; that output is not a backend-selection proof. Losing the master key makes the encrypted database unrecoverable. Export files contain plaintext private keys and are a different, much more sensitive backup boundary. ## Published Payload Matrix | Platform | Binary | Published in 0.4.0 | | ------------------- | -------------- | ------------------ | | macOS Apple Silicon | `monopass` | `darwin-aarch64` | | macOS Intel | `monopass` | `darwin-x86_64` | | Linux ARM64 | `monopass` | `linux-aarch64` | | Linux x86-64 | `monopass` | `linux-x86_64` | | Windows x86-64 | `monopass.exe` | `windows-x86_64` | There is no Windows ARM64 artifact. Touch ID, Secure Enclave, `se-test`, and `webauthn-rp-se-demo` are macOS-only even though the general passkey store and software WebAuthn paths are cross-platform. ## Choose the Right Mode | Need | Use | | ------------------------------------------------ | ---------------------------------------------- | | Browser/RP gives standard WebAuthn JSON | `passkey-create` or `passkey-get` | | CLI should complete registration/login over HTTP | `webauthn-rp-register` or `webauthn-rp-login` | | Building custom RP plumbing | `webauthn-register` / `webauthn-authenticate` | | Injecting a key into Chrome CDP | `assert`, `get --include-private`, or `export` | | Storing an API token rather than a passkey | [OpenCLIs Vault](/ai-clis/openclis-vault) | ## Relationships | Tool | Ownership | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------ | | [OpenCLIs Vault](/ai-clis/openclis-vault) | Stable keychain token access; MonoPass adds a structured encrypted passkey database and WebAuthn logic | | [MonoSurf](/monosurf) | Can automate browser/RP flows and CDP virtual-authenticator interop | | [Kernel CLI](/kernel-cli) | Provides OS/browser observation and actions, not passkey cryptography | | [OpenCLIs](/ai-clis/openclis) | Installs and updates the published MonoPass payload and agent skill |