PasskeyBridge —

Engineering · 2026-03-07

Building an Identity Threat Playbook in Under 10 Minutes

By J. W. Bouckaert

Building an Identity Threat Playbook in Under 10 Minutes

The finished pipeline

This tutorial configures the pipeline the product actually runs:

  1. Create a PasskeyBridge account and an API key
  2. Register a signal source under Settings
  3. Build a playbook that matches the event type you will send
  4. Post a test signal and read the event

Step 1: Create your account

Sign up at passkeybridge.io/auth. Starter is free, with 100 signals per month. Limits for each plan are on the pricing page.

Step 2: Register a signal source

Open Settings and the signal sources panel. Creating a source shows its signing secret once. Every source posts to the same ingest URL, https://api.passkeybridge.io/v1/shield-ingest. The body carries that source's id as source_id, and x-pb-signature is the hex HMAC-SHA-256 of the raw body under that source's secret.

A carrier lookup is a different call. It asks one provider: Vonage Number Insight or Twilio Lookup on the hosted add-on, or the Vonage application or Sinch Number Lookup project you registered.

Step 3: Build the playbook

Open Playbooks and create one. Set the signal type to the event type you will send, for example sim_swap. Add the actions you want. They run in parallel. Each one is bounded by an eight-second timeout. There is no order between them, and a failed action is not retried inside that request.

What the internal actions change, all inside PasskeyBridge:

  1. Suspend account deactivates this tenant's AI agent delegates and sets their trust score to zero.
  2. Revoke tokens tears down this tenant's open BLAST tunnels.
  3. Revoke sessions ends this tenant's active agent-to-agent negotiations.
  4. Freeze credentials invalidates this tenant's cached proofs.
  5. Webhook callback POSTs the event to your URL, signed when a callback secret is set. This is the action your backend uses to act on users in your own identity provider.
  6. Slack notification or email alert tells your team. Email goes to admins or to every member of the tenant.

Step 4: Send a test signal

Authenticate with your API key (x-pb-api-key). When the body names a registered source, sign it with that source's secret:

PAYLOAD='{"event_type":"sim_swap","source_id":"'"$SOURCE_ID"'","phone_hash":"a1b2c3d4e5f6789012345678901234567890123456789012345678901234abcd","risk_score":0.95}'
SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$SIGNING_SECRET" -hex | awk '{print $2}')

curl -X POST https://api.passkeybridge.io/v1/shield-ingest \
  -H "Content-Type: application/json" \
  -H "x-pb-api-key: $PB_API_KEY" \
  -H "x-pb-signature: $SIG" \
  -d "$PAYLOAD"

A sandbox key, or the x-pb-test-mode header, records state-changing playbook actions as skipped. The Events tab shows the signal, the matched playbook, and each action's status.

Inside the request

  1. API-key authentication and the tenant's rate limit
  2. HMAC-SHA-256 verification when the source is registered, or when the tenant requires a signature
  3. Keyed hash of a phone number under the server-held pepper, before any persistent write
  4. Playbook match on the event type you sent
  5. The actions above, in parallel
  6. An append-only audit row

Get started free

Start free · Test the API