Passkeys

Applies to: identity 0.26 · Checked: 26.09.2026

A passkey signs a person in without a password: with the device's fingerprint, face or PIN, or with a security key. The private half never leaves the device; identity keeps only the public one. The passkey is bound to identity's address, so a look-alike site never gets it.

Adding one

The Security tab of the portal /me has a Passkeys card. The person names the device and presses Add a passkey. The browser asks for the fingerprint, face or PIN and makes the key. The table shows whether it syncs through a password manager or lives on this device only, and when it was last used. Ten passkeys at most.

Signing in

Identity's sign-in page has a Sign in with a passkey button. No username is needed: the device offers the keys it holds for this site.

• When the device verified the person — fingerprint, face or PIN — that is both factors. No code is asked afterwards.
• When the key only registered a touch, it is the first factor. If the person has a second factor enabled, the code is asked.

Identity's sign-in page is what the portal /me, the console /admin, applications connected to identity over OIDC, and the platform's browser sign-in use when identity runs the sign-in (see who runs the sign-in). The mobile and desktop clients sign in with a password and do not use passkeys yet.

Worth knowing

• A second-factor reset by the help desk removes all of the person's passkeys too. They are usually lost together with the phone.
• A person removes a passkey themselves, in the same card.
• Every enrolment, removal and passkey sign-in is in the security event log.
• A passkey made on id.example.com works only there. After identity's public name changes, passkeys have to be added again.