diff --git a/src/adapter.c b/src/adapter.c
index c2c817e..0fd4c7d 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -4339,8 +4339,70 @@ int btd_adapter_passkey_reply(struct btd_adapter *adapter,
 				const bdaddr_t *bdaddr, uint8_t bdaddr_type,
 				uint32_t passkey)
 {
-	return mgmt_passkey_reply(adapter->dev_id, bdaddr, bdaddr_type,
-								passkey);
+	unsigned int id;
+	char addr[18];
+
+	ba2str(bdaddr, addr);
+	DBG("hci%u addr %s passkey %06u", adapter->dev_id, addr, passkey);
+
+	if (passkey == INVALID_PASSKEY) {
+		struct mgmt_cp_user_passkey_neg_reply cp;
+
+		memset(&cp, 0, sizeof(cp));
+		bacpy(&cp.addr.bdaddr, bdaddr);
+		cp.addr.type = bdaddr_type;
+
+		id = mgmt_reply(adapter->mgmt, MGMT_OP_USER_PASSKEY_NEG_REPLY,
+					adapter->dev_id, sizeof(cp), &cp,
+					NULL, NULL, NULL);
+	} else {
+		struct mgmt_cp_user_passkey_reply cp;
+
+		memset(&cp, 0, sizeof(cp));
+		bacpy(&cp.addr.bdaddr, bdaddr);
+		cp.addr.type = bdaddr_type;
+		cp.passkey = htobl(passkey);
+
+		id = mgmt_reply(adapter->mgmt, MGMT_OP_USER_PASSKEY_REPLY,
+					adapter->dev_id, sizeof(cp), &cp,
+					NULL, NULL, NULL);
+	}
+
+	if (id == 0)
+		return -EIO;
+
+	return 0;
+}
+
+static void user_passkey_request_callback(uint16_t index, uint16_t length,
+					const void *param, void *user_data)
+{
+	const struct mgmt_ev_user_passkey_request *ev = param;
+	struct btd_adapter *adapter = user_data;
+	struct btd_device *device;
+	char addr[18];
+	int err;
+
+	if (length < sizeof(*ev)) {
+		error("Too small passkey request event");
+		return;
+	}
+
+	ba2str(&ev->addr.bdaddr, addr);
+	DBG("hci%u %s", index, addr);
+
+	device = adapter_get_device(adapter, addr, ev->addr.type);
+	if (!device) {
+		error("Unable to get device object for %s", addr);
+		return;
+	}
+
+	err = device_request_passkey(device);
+	if (err < 0) {
+		error("device_request_passkey: %s", strerror(-err));
+		btd_adapter_passkey_reply(adapter, &ev->addr.bdaddr,
+					ev->addr.type, INVALID_PASSKEY);
+	}
 }
 
 static ssize_t adapter_get_pin(struct btd_adapter *adapter,
@@ -5359,6 +5421,11 @@ static void read_info_complete(uint8_t status, uint16_t length,
 						user_confirm_request_callback,
 						adapter, NULL);
 
+	mgmt_register(adapter->mgmt, MGMT_EV_USER_PASSKEY_REQUEST,
+						adapter->dev_id,
+						user_passkey_request_callback,
+						adapter, NULL);
+
 	set_dev_class(adapter, adapter->major_class, adapter->minor_class);
 
 	set_name(adapter, btd_adapter_get_name(adapter));
diff --git a/src/mgmt.c b/src/mgmt.c
index 987bd17..4e9d391 100644
--- a/src/mgmt.c
+++ b/src/mgmt.c
@@ -85,79 +85,6 @@ static bool get_adapter_and_device(uint16_t index,
 	return true;
 }
 
-int mgmt_passkey_reply(int index, const bdaddr_t *bdaddr, uint8_t bdaddr_type,
-							uint32_t passkey)
-{
-	char buf[MGMT_HDR_SIZE + sizeof(struct mgmt_cp_user_passkey_reply)];
-	struct mgmt_hdr *hdr = (void *) buf;
-	size_t buf_len;
-	char addr[18];
-
-	ba2str(bdaddr, addr);
-	DBG("index %d addr %s passkey %06u", index, addr, passkey);
-
-	memset(buf, 0, sizeof(buf));
-
-	hdr->index = htobs(index);
-	if (passkey == INVALID_PASSKEY) {
-		struct mgmt_cp_user_passkey_neg_reply *cp;
-
-		hdr->opcode = htobs(MGMT_OP_USER_PASSKEY_NEG_REPLY);
-		hdr->len = htobs(sizeof(*cp));
-
-		cp = (void *) &buf[sizeof(*hdr)];
-		bacpy(&cp->addr.bdaddr, bdaddr);
-		cp->addr.type = bdaddr_type;
-
-		buf_len = sizeof(*hdr) + sizeof(*cp);
-	} else {
-		struct mgmt_cp_user_passkey_reply *cp;
-
-		hdr->opcode = htobs(MGMT_OP_USER_PASSKEY_REPLY);
-		hdr->len = htobs(sizeof(*cp));
-
-		cp = (void *) &buf[sizeof(*hdr)];
-		bacpy(&cp->addr.bdaddr, bdaddr);
-		cp->addr.type = bdaddr_type;
-		cp->passkey = htobl(passkey);
-
-		buf_len = sizeof(*hdr) + sizeof(*cp);
-	}
-
-	if (write(mgmt_sock, buf, buf_len) < 0)
-		return -errno;
-
-	return 0;
-}
-
-static void mgmt_passkey_request(uint16_t index, void *buf, size_t len)
-{
-	struct mgmt_ev_user_passkey_request *ev = buf;
-	struct btd_adapter *adapter;
-	struct btd_device *device;
-	char addr[18];
-	int err;
-
-	if (len < sizeof(*ev)) {
-		error("Too small passkey_request event");
-		return;
-	}
-
-	ba2str(&ev->addr.bdaddr, addr);
-
-	DBG("hci%u %s", index, addr);
-
-	if (!get_adapter_and_device(index, &ev->addr, &adapter, &device, true))
-		return;
-
-	err = device_request_passkey(device);
-	if (err < 0) {
-		error("device_request_passkey: %s", strerror(-err));
-		mgmt_passkey_reply(index, &ev->addr.bdaddr, ev->addr.type,
-							INVALID_PASSKEY);
-	}
-}
-
 static void mgmt_passkey_notify(uint16_t index, void *buf, size_t len)
 {
 	struct mgmt_ev_passkey_notify *ev = buf;
@@ -322,7 +249,7 @@ static gboolean mgmt_event(GIOChannel *channel, GIOCondition cond,
 		DBG("device_unpaired event");
 		break;
 	case MGMT_EV_USER_PASSKEY_REQUEST:
-		mgmt_passkey_request(index, buf + MGMT_HDR_SIZE, len);
+		DBG("passkey_request event");
 		break;
 	case MGMT_EV_PASSKEY_NOTIFY:
 		mgmt_passkey_notify(index, buf + MGMT_HDR_SIZE, len);
diff --git a/src/mgmt.h b/src/mgmt.h
index 17d7393..deaa617 100644
--- a/src/mgmt.h
+++ b/src/mgmt.h
@@ -24,6 +24,3 @@
 
 int mgmt_setup(void);
 void mgmt_cleanup(void);
-
-int mgmt_passkey_reply(int index, const bdaddr_t *bdaddr, uint8_t bdaddr_type,
-							uint32_t passkey);