Passkeys

A passkey replaces the password with something the person’s device already has: a fingerprint, a face scan or a PIN. It cannot be phished, nothing needs remembering, and it syncs between a person’s devices through their platform (iCloud Keychain, Google Password Manager, a password manager). Passkeys use the standard called WebAuthn, which every current browser supports.

In Studio

Users & auth → Sign-in → Sign-in & registration → Ways to sign in → Passkeys.

Setting	Meaning	Key
Passkeys	Sign in with a fingerprint, face or device PIN. People add a passkey once they are signed in	`passkeys_enabled`
Passkey domain	The website domain passkeys belong to, such as `example.com`. A passkey made for one domain does not work on another	`passkey_rp_id`

Choose the Passkey domain carefully and early. It is the identity the device stores. Changing it later makes existing passkeys stop working. Use your registrable domain (example.com) so passkeys work on app.example.com and www.example.com alike.

Register a passkey

The person must already be signed in (by any method). The browser shows its own prompt.

const passkey = await pawabase.auth.passkeys.register({ name: "MacBook" });

# The browser creates the credential; a Python backend relays the challenge and verifies the answer.
challenge = pb.auth.passkeys.register_options()          # {"ticket": …, "options": …}
pb.auth.passkeys.register_verify(ticket=challenge["ticket"], credential=credential_from_browser, name="MacBook")

Give each passkey a name people recognise (“MacBook”, “Work phone”). It appears in their list. Where to put it: right after sign-in (“Sign in faster next time?”) and on the account page.

const session = await pawabase.auth.passkeys.signIn();                          // choose from saved passkeys
const same = await pawabase.auth.passkeys.signIn({ email: "ada@example.com" }); // start from an email

challenge = pb.auth.passkeys.authenticate_options(email="ada@example.com")
session = pb.auth.passkeys.authenticate_verify(ticket=challenge["ticket"], credential=credential_from_browser)

Call it from a button click. Without an email, the browser offers any passkey it has for your site. Put “Sign in with a passkey” next to the normal form.

Manage a person’s passkeys

const passkeys = await pawabase.auth.passkeys.list();
// [{ id, name, device_type, backed_up, transports, created_at, last_used_at }]

await pawabase.auth.passkeys.remove(passkeys[0].id);

passkeys = pb.auth.passkeys.list()
pb.auth.passkeys.remove(passkeys[0]["id"])

Show this list with Remove buttons. backed_up tells you whether the passkey syncs between devices. Encourage people to keep another sign-in method or a second passkey in case they lose a device. The auth webhook event for registration is user.passkey_added. See Auth webhooks.

Passkeys on a server or in a native app

In a browser, register and signIn do the whole ceremony. Elsewhere (a native app, a test), use the step-by-step calls: request options, hand them to the platform’s WebAuthn, and send back what it returns with the ticket.

const { ticket, options } = await pawabase.auth.passkeys.requestSignIn({ email });
// give `options` to the platform's WebAuthn API, get a credential back
const session = await pawabase.auth.passkeys.finishSignIn({ ticket, credential });

requestRegistration and finishRegistration do the same for registering.

When it fails

What you see	Meaning
The prompt is cancelled	The person dismissed it. Fall back to another method
An error before any prompt	The browser has no WebAuthn support, or the page isn’t on HTTPS (`localhost` is fine)
`AuthenticationError` after the prompt	No matching passkey for this site
Passkeys stopped working after a change	The Passkey domain changed

Two-step verification

An extra step on top.

Sessions

After sign-in.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

Register a passkey

Manage a person’s passkeys

Passkeys on a server or in a native app

When it fails

Two-step verification

Sessions

​In Studio

​Register a passkey

​Sign in with a passkey

​Manage a person’s passkeys

​Passkeys on a server or in a native app

​When it fails

Two-step verification

Sessions

In Studio

Register a passkey

Sign in with a passkey

Manage a person’s passkeys

Passkeys on a server or in a native app

When it fails