You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/end-user-flows/sign-up-and-sign-in/passkey-sign-in.mdx
+16-16Lines changed: 16 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ Passkey sign-in lets users authenticate with a WebAuthn credential directly duri
8
8
9
9
This document explains how passkey sign-in works in Logto's built-in sign-in experience, what the different entry paths look like for end users, and how it interacts with MFA.
10
10
11
-
## How passkey sign-in works
11
+
## How passkey sign-in works\{#how-passkey-sign-in-works}
12
12
13
13
To use passkey sign-in, you first need to enable it in the <CloudLinkto="/sign-in-experience/sign-up-and-sign-in">sign-in experience</CloudLink> configuration. After it is enabled, Logto can offer passkey sign-in in up to three ways on the sign-in page:
14
14
@@ -34,9 +34,9 @@ flowchart LR
34
34
I --> J["Sign-in succeeds"]
35
35
```
36
36
37
-
## Three passkey sign-in paths
37
+
## Three passkey sign-in paths\{#three-passkey-sign-in-paths}
38
38
39
-
### 1. Show "Continue with passkey" button enabled
39
+
### 1. Show "Continue with passkey" button enabled\{#1-show-continue-with-passkey-button-enabled}
40
40
41
41
When `Show "Continue with passkey" button` option is enabled, the sign-in page shows a `Continue with passkey` button at the bottom of the first screen.
42
42
@@ -50,7 +50,7 @@ The user flow is:
50
50
51
51
This is the most direct path. It is best for users who already know they have a saved passkey and want a one-step login experience.
52
52
53
-
### 2. Show "Continue with passkey" button disabled
53
+
### 2. Show "Continue with passkey" button disabled\{#2-show-continue-with-passkey-button-disabled}
54
54
55
55
When `Show "Continue with passkey" button` option is disabled, Logto switches to an identifier-first experience on the first screen. The page only asks for the user's identifier first.
56
56
@@ -76,7 +76,7 @@ flowchart LR
76
76
I --> G
77
77
```
78
78
79
-
### 3. Allow prompting and autofill
79
+
### 3. Allow prompting and autofill\{#3-allow-prompting-and-autofill}
80
80
81
81
When `Allow prompting and autofill` option is enabled, compatible browsers can show the pre-saved passkeys directly from the identifier input field.
82
82
@@ -90,7 +90,7 @@ The user flow is:
90
90
91
91
This flow is especially useful on devices where passkeys are already synced by the platform, because users can sign in without manually moving to a second page or tapping a dedicated passkey button.
92
92
93
-
## Sign-up and passkey binding flow
93
+
## Sign-up and passkey binding flow\{#sign-up-and-passkey-binding-flow}
94
94
95
95
Passkey sign-in is not only a sign-in entry point. It also affects what happens after registration, because the same WebAuthn credential can later be reused for both sign-in and MFA.
96
96
@@ -120,9 +120,9 @@ flowchart LR
120
120
M --> H
121
121
```
122
122
123
-
## Relationship between passkey sign-in and MFA
123
+
## Relationship between passkey sign-in and MFA\{#relationship-between-passkey-sign-in-and-mfa}
A passkey used for passkey sign-in is backed by a WebAuthn credential, and that credential is also treated as a WebAuthn MFA factor. Because of that, passkey sign-in and WebAuthn MFA are effectively equivalent from the credential perspective.
128
128
@@ -133,7 +133,7 @@ That leads to two important behaviors:
133
133
134
134
In other words, a successful passkey sign-in already satisfies the WebAuthn-based identity verification that would otherwise be required during MFA.
135
135
136
-
### Binding a passkey does not automatically force MFA for user-controlled tenants
136
+
### Binding a passkey does not automatically force MFA for user-controlled tenants\{#binding-a-passkey-does-not-automatically-force-mfa-for-user-controlled-tenants}
137
137
138
138
For users in tenants where MFA is not mandatory, binding a passkey during sign-up or account setup does not automatically turn on MFA for the account.
139
139
@@ -146,25 +146,25 @@ On that page, the user can:
146
146
147
147
If the user chooses to enable MFA, Logto then continues with the normal MFA setup flow and may ask the user to bind additional factors, depending on the tenant's MFA configuration. For example, if other MFA factors are enabled for the tenant, Logto can continue with binding another factor or backup codes.
148
148
149
-
### What happens when passkey sign-in is disabled later
149
+
### What happens when passkey sign-in is disabled later\{#what-happens-when-passkey-sign-in-is-disabled-later}
150
150
151
151
If passkey sign-in is turned off later, the previously bound passkey is still a WebAuthn credential. That means it can continue to work as an MFA factor as long as WebAuthn MFA remains available for the tenant.
152
152
153
153
Disabling passkey sign-in removes the passkey as a direct sign-in entry point, but it does not invalidate the underlying WebAuthn MFA credential.
154
154
155
-
## Limitations and compatibility
155
+
## Limitations and compatibility\{#limitations-and-compatibility}
156
156
157
157
- Passkey sign-in is not available for Enterprise SSO users.
158
158
- Passkey sign-in depends on browser and platform WebAuthn support.
159
159
- "Allow prompting and autofill" only works in browsers and environments that support passkey autofill / conditional UI.
160
160
- Passkeys are origin-bound. A passkey registered for one domain cannot be used on another domain.
161
161
162
-
## Q&A
162
+
## Q&A\{#q-a}
163
163
164
164
<details>
165
165
<summary>
166
166
167
-
### Does passkey sign-in still require MFA verification?
167
+
### Does passkey sign-in still require MFA verification?\{#does-passkey-sign-in-still-require-mfa-verification}
168
168
169
169
</summary>
170
170
@@ -175,7 +175,7 @@ No. A successful passkey sign-in already satisfies the WebAuthn-based verificati
175
175
<details>
176
176
<summary>
177
177
178
-
### Can a passkey bound for passkey sign-in still be used as an MFA factor after passkey sign-in is disabled?
178
+
### Can a passkey bound for passkey sign-in still be used as an MFA factor after passkey sign-in is disabled?\{#can-a-passkey-bound-for-passkey-sign-in-still-be-used-as-an-mfa-factor-after-passkey-sign-in-is-disabled}
179
179
180
180
</summary>
181
181
@@ -186,7 +186,7 @@ Yes. Passkey sign-in and WebAuthn MFA are backed by the same underlying credenti
186
186
<details>
187
187
<summary>
188
188
189
-
### Can Enterprise SSO users use passkey sign-in?
189
+
### Can Enterprise SSO users use passkey sign-in?\{#can-enterprise-sso-users-use-passkey-sign-in}
190
190
191
191
</summary>
192
192
@@ -197,7 +197,7 @@ No. Enterprise SSO users are not eligible for passkey sign-in.
197
197
<details>
198
198
<summary>
199
199
200
-
### Does passkey sign-in still require CAPTCHA?
200
+
### Does passkey sign-in still require CAPTCHA?\{#does-passkey-sign-in-still-require-captcha}
0 commit comments