Secure enrollment of passkeys with verifiable credentials

A system, comprising:

• one or more processors;
• and
• at least one memory comprising instructions that, when executed by the one or more processors, cause the system to:
• receive a first request for access to a resource system, the first request generated by a user device;
• encode, into image data, a specification for generating verifiable presentations;
• send the image data to the user device;
• receive, from the user device in response to the image data, a verifiable presentation corresponding to the specification;
• verify that the verifiable presentation demonstrates possession of a verified credential corresponding to access to the resource system;
• in response to verifying the verifiable presentation, send, to the user device, first data representing information for generating a passkey;
• receive, from the user device in response to the first data, second data including a first public key corresponding to a first passkey pair generated by the user device based on the first data;
• and
• register the first public key as corresponding to access to the resource system.

A computer-implemented method comprising:

• sending, from a user device to one or more system components separate from the user device, a first request for access to a resource system;
• receiving, in response to the first request, first image data encoding a specification for generating verifiable presentations;
• scanning, using a digital wallet application of the user device, an image corresponding to the first image data;
• presenting a first prompt for approval to generate a first verifiable presentation;
• in response to receiving approval to generate the first verifiable presentation, generating first data representing the first verifiable presentation, the first data corresponding to the specification;
• sending the first data to the one or more system components;
• receiving, in response to the first data, second data representing information for generating a passkey;
• presenting a second prompt for approval to generate the passkey;
• in response to receiving approval to generate the passkey, generating, using the digital wallet application, a first passkey pair including a first public key and a corresponding first private key;
• and
• sending the first public key to the one or more system components, the one or more system components registering the first public key as corresponding to access to the resource system.