$HEADLESS SYSTEMS
03 / Scorecard / Auth & Identity

Hanko

C
Headless Index
50/100
JAIRF
82.5/100
AI-Ready
Verified
MAY 21, 2026
Methodology v1 · JAIRF v1.0.0

Powered by JAIRF v1.0.0 by Jentic · open methodology at /the-headless-index/methodology

Editorial verdict
Hanko is partially headless and partly UI-led. The Headless Index thesis-fit score of 50/100 puts it mid-table on the index, and JAIRF v1.0.0 puts it at 82.5/100 (Level 3, AI-Ready). In practice, vendors at this tier are partly machine-consumable: the core flows are reachable through code but several adjacent surfaces still expect a human at a dashboard, and the rest of this verdict explains where Hanko lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. Hanko is passkey-first identity with the Public API for end-user flows and the Admin API for management. JavaScript SDK including a passkey-enabled web component is the client surface. Modern web platform primitives are explicit design choices; the product leans into WebAuthn rather than treating it as one provider among many.[1] Schema observability is the related test: can an agent introspect the contract from cold, or does it have to read prose documentation to do so? REST documentation is detailed at docs.hanko.io. OpenAPI references exist for some surfaces; not all of the API is reachable through a single canonical OpenAPI URL.[2] An agent can drive parts of this product, but not all of it: integrators should plan for human-in-the-loop checkpoints where the headless surface stops short. On headless operability: Most identity workflows are programmable through the Admin API. The admin surface is narrower than enterprise-tier IdPs (no SAML, no directory sync, narrower MFA matrix), but it is sufficient for consumer and prosumer use cases.[3] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No first-party Hanko MCP server has been published. The product focus is passkey adoption, not agent integration.[4] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Hanko Webhooks deliver signed events for identity lifecycle changes. Event catalog is modest but well-scoped to the passkey-and-modern-identity use case. Net assessment: integrators can build agent flows against Hanko, but the rough edge to plan around is MCP posture[5]. Expect to wrap missing pieces in bespoke glue or accept human-in-the-loop checkpoints. Workable but requires scaffolding.
Verdict by Headless Index pipeline (auto)
// AI-drafted from the evidence layer. Editorial review pending.
Scores

Scorecard detail

Headless Index · 5 sub-criteria
API-first design intent14/20
scored

Hanko is passkey-first identity with the Public API for end-user flows and the Admin API for management. JavaScript SDK including a passkey-enabled web component is the client surface. Modern web platform primitives are explicit design choices; the product leans into WebAuthn rather than treating it as one provider among many.

signals (4)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • +OpenAPI specPublished, 0 operations
  • ·GraphQL endpointDiscovered at https://www.hanko.io/graphql, introspection disabled or scoped
  • −SDKs maintainedNone detected in vendor org
cite (1)
  • github.sdks@2026-05-20
Headless operation12/20
scored

Most identity workflows are programmable through the Admin API. The admin surface is narrower than enterprise-tier IdPs (no SAML, no directory sync, narrower MFA matrix), but it is sufficient for consumer and prosumer use cases.

signals (9)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −API operations exposedOpenAPI present but operations could not be counted
  • ·Docs pages crawled0 pages (crawler: none)
  • ·Auth schemes documentedAuth documentation page not reached by crawler
  • ·Setup / quickstart docsNot reached by crawler
  • ·Billing docsNot reached by crawler
  • ·Teams / org docsNot reached by crawler
  • ·CLI docsNot reached by crawler
  • ·Schema / data model docsNot reached by crawler
cite (1)
  • github.sdks@2026-05-20
MCP & agent posture4/20
scored

No first-party Hanko MCP server has been published. The product focus is passkey adoption, not agent integration.

signals (4)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −Official MCP serverNone found in vendor's GitHub org or the official MCP registry
  • −Community MCP serversNone found
  • −Agent-friendly SDKsNo TypeScript/JavaScript SDK published (agents commonly run in TS/JS)
cite (1)
  • mcp.found@2026-05-20
Schema observability12/20
scored

REST documentation is detailed at docs.hanko.io. OpenAPI references exist for some surfaces; not all of the API is reachable through a single canonical OpenAPI URL.

signals (3)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • +OpenAPIPublished at https://raw.githubusercontent.com/teamhanko/docs/main/openapi-public.yaml (OpenAPI undefined, 0 operations)
  • ·GraphQL introspectionGraphQL endpoint at https://www.hanko.io/graphql but introspection is disabled, scoped, or behind authentication
cite (1)
  • openapi.discovered@2026-05-20
Webhooks & events8/20
scored

Hanko Webhooks deliver signed events for identity lifecycle changes. Event catalog is modest but well-scoped to the passkey-and-modern-identity use case.

signals (2)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • ·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.
cite (1)
  • ai_review_browser.webhooks@2026-05-20
JAIRF · 6 dimensions
FCFoundational Compliance
100/100

Structural validity, standards conformance, and parsability of the OpenAPI specification.

DXJDeveloper Experience & Tooling Compatibility
70.5/100

Documentation clarity, example coverage, response completeness, and ingestion health.

ARAXAI-Readiness & Agent Experience
68.8/100

Semantic clarity, intent expression, datatype specificity, and error standardization.

AUAgent Usability
86.1/100

Operational composability, complexity comfort, navigation affordances, and safety patterns.

SECSecurity
84.1/100

Authentication strength, transport security, secret hygiene, and OWASP risk posture.

AIDAI Discoverability
83.8/100

Descriptive richness, intent phrasing, workflow context, and registry signals.

Band rationale:C band: scores 40-75 range

04 / Embed

Show Hanko's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

Hanko mini badge preview
Get embed code
Peers in Auth & Identity
LogtoC
Headless Index 50/100
FusionAuthC
Headless Index 51/100
Firebase AuthenticationC
Headless Index 49/100
See full Auth & Identity ranking →