Skip to content

Signing in with a passkey (experimental)

Many brokers now have you sign in with a passkey. If yours does, briskapi can do the sign-in for you and keep the BRiSK session cookies, instead of you copying them from a browser. It works with the BRiSK sites of SBI, Matsui, Monex, SMBC Nikko and Tachibana e-shiten, or any broker you add. It needs Chrome, Node 22+ and a safe place for the passkey: the macOS Keychain or Windows Credential Manager (on Linux, an owner-only file you opt into). It runs on macOS and Windows (run it from PowerShell or cmd so it uses Windows' own Chrome and Node, not WSL's) and is also tested on Linux.

How it works

A passkey is a pair of keys. The broker keeps the public half. The private half normally lives in your phone, laptop or password manager, where a fingerprint or PIN lets it sign a challenge the broker sends, which proves it is you. briskapi borrows that arrangement. It starts its own Chrome, which has a virtual authenticator: software that plays the part of your phone and signs without asking. The broker's site cannot tell the difference.

  1. Once, brisk enroll. You pick your broker. A separate Chrome window opens on its login page (a temporary profile, not your everyday Chrome). Sign in as you normally would, then register a new passkey in the broker's security settings, just as you would for a new phone. The virtual authenticator receives it. When the site says it is registered, press Enter in the terminal: briskapi saves the passkey and your broker choice in the macOS Keychain or Windows Credential Manager, and Chrome closes. At e-shiten, enroll first asks for your user ID, because its passkey form wants the ID before the passkey; it is saved with the passkey. The window opens at e-shiten's usual sign-in (user ID, PIN and phone-number authentication), and the passkey is registered on the screen shown after signing in or under お客様情報 › 設定情報 › パスキー認証.
  2. Each session, brisk login. The same Chrome opens with the saved passkey loaded, goes to the login page and presses the passkey button, and the virtual authenticator signs. Open BRiSK from the broker's site in that window (or pass --launch-url to have it opened for you). briskapi reads the BRiSK session cookies, saves them and closes Chrome.
  3. Then use it. For each of the five brokers, brisk live --site sbi (or its own site) and the briskapi.brisk API use the saved cookies. For a broker you add yourself briskapi has no data client, so the cookies are only saved (under ~/.config/brisk/cookies/) for your own use.

Your existing passkeys on your phone or in a password manager are not touched. The broker simply lists one more passkey, which you can delete in its security settings.

What to know

  • The saved passkey is a credential. Whoever has it can sign in to your broker account with no further check. It is kept only in the Keychain or Credential Manager (BRISK_PASSKEY_STORE=file keeps it in an owner-only file instead, which is weaker; on Windows that file's privacy comes from your user profile folder, which only you and administrators can read), never leaves your machine and is never shown in a log. For e-shiten your user ID is kept with it, in the same place. brisk forget deletes it here; remove it at the broker too.
  • It is experimental. Each broker's login page, passkey button text and BRiSK launch come from its public pages, and none has been tried against a live account. Override them with --login-url, --passkey-button and --launch-url, or in sites.json below, and please report what fails.
  • A broker may refuse it. Chrome tells the site it is being automated. Check that your broker's terms allow this before relying on it.

Commands

brisk sites                    # the brokers you can pick, and where their BRiSK lives
brisk enroll [--site matsui]   # once; you are asked to choose a broker if you don't say
brisk login                    # each session; the broker is the one you enrolled with
brisk forget                   # delete the saved passkey

From Python: passkey.enroll(site="matsui") (for e-shiten, passkey.enroll(site="e-shiten", user_id="...")) and signin = passkey.login(), where signin.cookies are the BRiSK cookies and signin.client is the data client for sites that have one.

To add a broker, or correct a built-in one, edit ~/.config/brisk/sites.json:

{"sites": [{"id": "mybroker", "name": "My Broker", "login_url": "https://broker.example/login",
            "cookie_host": "mybroker.brisk.jp", "passkey_button": "Sign in with a passkey"}]}

Other keys: cookie_prefix, launch_url, enroll_url (where enroll starts, if the first sign-in is on another page than the passkey one) and user_field (a CSS selector for a user ID box that must be filled before the passkey control works; enroll then asks for the ID).

How it works inside: ARCHITECTURE.md.