Methods and systems for facilitating single sign-on and passwordless sign-on

A computer-implemented method for facilitating passwordless sign-on to a web service provider, the method comprising:

• receiving, on a client device, user input to access a cryptographically protected resource provided by a web service provider;
• sending an authentication request to the web service provider to initiate an authentication process for a user on the client device to access the cryptographically protected resource;
• receiving, from the web service provider, a passkey challenge for the user;
• displaying a prompt on a display of the client device for the user to complete the passkey challenge with a passkey manager on the client device via user input on the client device;
• after the user completes the passkey challenge with the passkey manager to access a passkey stored on the client device and corresponding to an account of the user's with the web service provider, receiving, from the passkey manager, a passkey assertion generated by the passkey manager using the passkey corresponding to the user's account with the web service provider;
• sending the passkey assertion and a device identifier corresponding to the client device to the web service provider;
• after the web service provider confirms validity of the passkey assertion, receiving information conveying an encrypted credential bundle from the web service provider, the encrypted credential bundle corresponding to the user's account with the vault service provider and the client device, wherein the encrypted credential bundle is symmetrically encrypted using a device key previously generated on the client device and corresponding to the user's account with the web service provider and the client device, the encrypted credential bundle including at least an encrypted first key;
• retrieving, from local storage on the client device, the device key corresponding to the user's account with the web service provider and the client device;
• decrypting the encrypted credential bundle using the device key to obtain the first key;
• and
• using the first key to access the cryptographically protected resource provided by the web service provider.