Activate Passkeys and Let Your Users Log in without a Password

carlastabile
Fri, 01 Mar 2024 16:58:17 +0000

hey @riku-df welcome to the Auth0 Community! I’m also really excited about passkeys and I’m glad to see folks are as well!

So let me go through your message and see if I can help out:

riku-df:

Recovering account access after losing a passkey
If a user with a passkey is locked out (by losing their device / yubikey etc), there is no way to securely recover the account access.

Not-so-secure Workaround:
The user could recover access by clicking “Can’t login to your account?” on the Universal Login screen, send a password reset email and set a new password. However, from that point the user will be stuck in password login state. The passkey security benefit is gone.

If a user using a passkey is locked out, you can go through the password recovery flow as you mentioned. However the passkey benefit won’t be gone, once you have set a password you can create a new passkey for your account in another device (I actually tested this with my phone and my mac)

Feature request:
“Send a passkey enrollment invitation ” feature

This is a great point! our product team is actually considering it for a future iteration.

Hope this helps a bit! let me know if you have any other questions