Passkeys (FIDO2 / WebAuthn)

Passkeys provide phishing-resistant MFA using the WebAuthn standard (FIDO2). Instead of entering a one-time code, the user authenticates with a hardware security key (e.g., YubiKey), a platform authenticator (e.g., Windows Hello, Touch ID, Face ID), or a passkey synced through a password manager.

When used as an MFA factor, passkeys operate with userVerification: "discouraged" — the first factor (password) already established identity, so the passkey only needs to prove possession of the credential (User Presence).

INFO

MFA passkeys are stored in the ProAuth database (in the ProAuthUserMfaFactor entity), separate from login passkeys which are stored in the User Store database. This allows MFA passkeys to work with both User Store and federated identity providers (e.g., Google, Entra ID).

TIP

The first MFA passkey is registered during the initial MFA challenge. Users can register additional passkeys and manage existing ones through the Account Management portal.

Create Passkey MFA Instance

Steps to create a new Passkey MFA instance:

1. Navigate to the ProAuth Admin UI and log in with a user that has at minimum SubscriptionAdmin role
2. Navigate to MFA Instances and click Create MFA Instance
3. Choose the MFA Type Passkey
4. Enable the Active flag
5. Choose the proper Subscription
6. Click Save

Configure Passkey MFA

After creating the MFA instance, complete the configuration:

1. Open the MFA instance in the extended edit view
2. Assign the MFA instance to the required Tenants, IDPs, Client Applications, or ProAuth Users

WARNING

The Passkey MFA module derives the WebAuthn RP ID from BaseServiceSettings:HostUrl. The PasskeyRpName option on the MFA instance controls the relying-party display name for clients that expose it.

How Passkey MFA Works

Differences from TOTP

Feature	TOTP	Passkey
Phishing resistance	❌ Codes can be phished	✅ Bound to origin
User interaction	Enter 6-digit code	Touch authenticator
Requires device	Authenticator app	Security key or platform authenticator
Offline support	✅ Works offline	✅ Works offline
Code entry	Manual	Automatic