Understand passkey sync across devices via iCloud Keychain and Google Password Manager

Steps

1. When a passkey is registered with residentKey=required on an Apple device, iOS/macOS stores it in iCloud Keychain; it is automatically synced to other devices signed in with the same Apple ID under the same iCloud Keychain access group.
2. On Android, passkeys registered via the Credential Manager API are stored in Google Password Manager and synced across Android devices signed in with the same Google Account.
3. The credentialBackedUp flag (bit 3 of authenticatorData flags byte) indicates the passkey is synced/backed up; credentialSourceType is discoverable-credential.
4. From a relying party perspective, synced passkeys behave identically to device-bound passkeys — the same credential ID and public key work on all synced devices; no special server-side handling is needed.
5. To distinguish synced from hardware-bound credentials, check the credentialBackedUp flag during registration and store it; use this metadata to apply risk policy (e.g. high-value operations may require hardware-bound credentials).