Public key
The half of a key pair you can share. It's made from the private key, and it lets anyone check a signature without being able to make one.
Every private key has a public key made from it, by a calculation that’s easy one way and, with today’s computers, impractical to reverse. The private key signs; the public key lets anyone check that a signature came from it, without being able to sign. That’s how a network confirms that a payment was authorized without ever seeing the secret.
On bitcoin, an address is made from a public key, or from a script that names several, as in a multisig wallet. A passkey works the same way: the website stores your public key, which isn’t a secret, and a site that leaks it gives attackers nothing they can sign in with.
Public, but not for everyone
A public key can’t move money, but it can reveal it. Wallets that follow BIP32, a standard from 2012, make their addresses from an extended public key, often called an xpub. The standard’s own example is an auditor who, given that key, can see every transaction in and out of the wallet, but not a single key that could move the money. Give an xpub to an app, a service or a stranger, and they can follow every payment the wallet has received, and every one it will.
BIP32 also warns that an extended public key, together with the private key behind any one of its addresses, is enough to work out the private key it came from, and with it every key made from that. Treat an extended public key as something you don’t share. A multisig wallet’s descriptor holds the extended public keys of all its keys, so the same goes for it.