Passwordless sign-in with passkeys (WebAuthn): Face ID, Touch ID, Windows Hello, Android and security keys.
#Turn on passkeys
In Studio → Authentication → Sign-in methods → Passkeys, enable passkeys. A passkey is bound to a domain (the relying party ID): by default your Site URL's host, and requests are accepted from your Site URL's origin. Set your own domain and origins there if your app runs elsewhere (several origins are allowed, comma-separated). Users can have up to 10 passkeys by default.
#How it works
Your app gets options from the Auth API, passes them to the browser's WebAuthn API (navigator.credentials.create() / get()), and sends the result back:
| Step | Endpoint | Who |
|---|---|---|
| Add a passkey: get options | POST /auth/v1/passkeys/registration/options | Signed-in user |
| Add a passkey: verify | POST /auth/v1/passkeys/registration/verify | Signed-in user |
| Sign in: get options | POST /auth/v1/passkeys/authentication/options | Anyone (API key) |
| Sign in: verify → session | POST /auth/v1/passkeys/authentication/verify | Anyone (API key) |
| List / rename / delete passkeys | GET / PATCH / DELETE /auth/v1/passkeys | Signed-in user |
Send the project API key in the apikey header and, for a signed-in user, Authorization: Bearer <access token>. A passkey sign-in is a full session like a password sign-in.