Let’s talk about the company that wants to be the only key to every door you will ever open.
Not one door. Every door.
The front door of your apartment. The login screen of your bank. The check-in counter at the airport. The patient intake at a clinic. The payment terminal at the hardware store. The rental agreement you sign to get the keys to the new place.
Apple, Google, Meta, and Microsoft are all racing to become your universal identity provider. Not your email provider. Not your browser. Your identity. The set of claims that proves you are who you say you are when you need to cross a border, authorize a payment, pick up a prescription, or prove your age.
This is not the same game with a new name. This is a different layer of capture than anything that came before.
Here is what is happening right now.
Apple has been expanding Wallet to hold state-issued driver’s licenses, passport data, and employment credentials. The passkey infrastructure they launched a couple of years ago is now the backbone of how millions of people authenticate across apps and websites. But the ambition goes further. The Wallet is becoming a document holder — not just for payment cards, but for everything you need to prove about yourself in the physical world.
Google matched with the Identity Credential API on Android. Same play. Put government IDs, employee badges, and student cards into the phone. Make Android the identity hub. Make leaving Android mean losing your identity infrastructure.
Meta launched “Verify Me” — a universal digital identity service that links your real-world identity to your account. They frame it as safety and trust. The revenue model is a subscription, and the data model is the most complete personal profile ever assembled.
Microsoft is building the enterprise side with Entra Verified ID — decentralized identity federation for corporate access, contractor verification, and credential issuance. Same play, different buyer.
And then there is the EU Digital Identity Wallet. A government-mandated, state-backed identity framework that every EU member state has to implement. Apple and Google are already positioning their wallets as the carriers.
The pattern is not subtle once you see it.
Here is what is actually being built.
An identity layer that sits below everything. Below your apps. Below your banking relationships. Below your healthcare access. Below your travel documents. Below your employment credentials.
The platform that controls this layer does not need to build a better product to keep you. They do not need better search, better social features, or better maps. You will stay because leaving means rebuilding your identity infrastructure from scratch.
Think about what switching costs look like at this level.
Today, leaving a platform means losing your photos, your contacts, your saved preferences. Annoying, but survivable. There are export tools. There are workarounds.
Leaving an identity provider means losing the digital key that unlocks your bank account, your health records, your government services, your professional credentials, your rental history, your travel privileges.
That is not an annoyance. That is a structural barrier.
The platforms know this. That is why the investment in identity is accelerating even though the profit margins on identity services are thin right now. The profit is in the lock-in that compounds over the next decade.
Now here is what people are missing.
The conversation is framed as security and convenience. Safer than passwords. Harder to phish. Faster than typing. One tap to authenticate.
All of that is true. Passkeys are more secure than passwords. Biometrics are harder to steal than pins. The convenience is real.
But that framing obscures the question nobody in the press is asking:
Who controls the infrastructure that proves who you are?
Because the answer to that question determines who gets to say who you are.
If Apple is your identity provider and their systems flag your account as suspicious, you do not just lose access to iCloud. You lose access to every service that relies on Apple’s identity verification. Which if the rollout continues as planned, will be most of them.
If Meta flags your face as a duplicate or a fake, you do not just lose your social feed. You lose the verified identity you tied to your banking, your travel bookings, your professional credentials.
That is not a hypothetical. That is the design.
Centralized identity infrastructure creates a single point of failure for your entire digital existence. And the platforms are designing that failure point into their profit model.
Here is the operator lesson.
If you are building a product that depends on identity verification — fintech, healthtech, property, marketplaces, professional services — you need to stop treating identity as solved by the platform providers.
The cheapest path is to lean on Apple or Google or Meta identity. The cheapest path is also the path that makes your entire business dependent on a competitor who will eventually change the terms.
The smart play is to build on portable, verifiable credential infrastructure that is not owned by any single platform. W3C Verifiable Credentials. Decentralized identifiers. Consent receipts that the user controls. Yes, it is harder than calling the Apple or Google API. That is the point.
The platforms are making identity easy specifically so that you never build the alternative.
The deeper principle is this.
Identity is not a feature of the platform. It is the foundation of personhood in a digital society.
If you cannot prove who you are without permission from a trillion-dollar corporation, you do not have digital sovereignty. You have a rental agreement.
If leaving a platform means losing access to healthcare, banking, and government services, you are not a user. You are a tenant.
The platforms are not building identity infrastructure to serve you. They are building it to own the relationship between you and every institution you will ever need to interact with.
And they are doing it with your consent, your participation, and your enthusiasm.
Because it is convenient. Because it is secure. Because it is better than passwords.
All of that is true.
And none of it changes what is being built.
A universal identity layer, owned by a handful of companies, that turns your access to society into a platform service.
The question is not whether the passkey works better than the password. The question is whether you will ever be able to prove who you are without asking for permission from the company that sells your attention, trains its models on your behavior, and has every incentive to make sure you never leave.
The passkey opens the door.
The question is who holds the master key.