Passkeys & WebAuthn
Passkeys provide passwordless authentication using the FIDO2/WebAuthn standard. The user authenticates with a biometric (fingerprint, face) or hardware security key, and your server never handles a shared secret. The private key never leaves the device; LumoAuth stores only the public key and verifies a signed challenge at login.
What Are Passkeys?
Passkeys are cryptographic credentials stored on the user's device. They use public-key cryptography — the private key never leaves the device, and the public key is stored in LumoAuth. Authentication happens via a challenge-response, which makes passkeys:
- Phishing-resistant — bound to the specific origin (domain).
- Free of shared secrets — nothing reusable to steal from the server.
- Biometric-backed — require fingerprint, face, or PIN to use.
- Cross-device — can sync across devices via platform credential managers.
Supported Credential Types
| Type | Examples | Use Case |
|---|---|---|
| Platform Authenticators | Touch ID, Face ID, Windows Hello | Built into the device |
| Roaming Authenticators | YubiKey, Titan Security Key | USB/NFC hardware keys |
| Synced Passkeys | iCloud Keychain, Google Password Manager, 1Password | Cross-device passkeys |
How It Works
Registration (Enrollment)
- User navigates to account security settings.
- Clicks Add Passkey.
- Browser prompts for biometric verification or security key.
- A new public-private key pair is generated on the device.
- The public key is stored in LumoAuth.
- The passkey is ready to use.
Authentication
- User enters their email (or clicks Sign in with Passkey).
- LumoAuth sends a cryptographic challenge to the browser.
- Browser prompts for biometric verification.
- The private key on the device signs the challenge.
- LumoAuth verifies the signature with the stored public key.
- Login is complete — no password needed.
Configuration
Enable Passkeys
Navigate to Configuration → Auth Settings at:
/orgs/{orgId}/portal/configuration/auth-settings
Under Authentication Methods, toggle Passkeys / WebAuthn to enabled.
Settings
| Setting | Description |
|---|---|
| Allow Passkey Registration | Users can create passkeys in account settings |
| Allow Passkey Login | Users can log in with passkeys |
| Require User Verification | Enforce biometric/PIN (recommended) |
| Attestation Preference | none, indirect, or direct attestation |
| Authenticator Types | Allow platform, roaming, or both |
WebAuthn Routes
LumoAuth exposes WebAuthn endpoints for registration and authentication:
POST /webauthn/register/options → Generate registration options
POST /webauthn/register → Complete registration
POST /webauthn/authenticate/options → Generate authentication options
POST /webauthn/authenticate → Verify authentication
These endpoints follow the WebAuthn specification and are used by the browser's built-in navigator.credentials API.
User Experience
Enrolling a Passkey
From the account security page:
/account/security
- Click Add Passkey.
- Name the passkey (e.g., "MacBook Touch ID", "YubiKey").
- Complete the biometric prompt.
- The passkey appears in the list of enrolled credentials.
Logging In with a Passkey
On the login page:
- Click Sign in with Passkey (or start typing an email).
- The browser shows available passkeys.
- Select a passkey and verify with biometrics.
- Login proceeds — no password or MFA needed.
Managing Passkeys
Users can manage their passkeys from account settings:
- View all enrolled passkeys with names and creation dates.
- Delete individual passkeys.
- Add new passkeys.
Passkeys as MFA
Passkeys can also be used as a second factor alongside password authentication:
- User enters email and password.
- Instead of TOTP/SMS, the system prompts for a passkey.
- User verifies with biometrics.
- MFA is satisfied.
This provides phishing-resistant, hardware-backed MFA.
Security Benefits
| Feature | Passwords | Passkeys |
|---|---|---|
| Phishing risk | High — can be entered on fake sites | None — bound to origin |
| Server breach | Hashed passwords can be cracked | Only public keys stored |
| Replay attacks | Possible | Impossible — challenge-response |
| User effort | Remember complex passwords | Touch fingerprint sensor |
| Cross-site | Same password often reused | Unique per site |
Browser Support
Passkeys are supported in:
- Chrome 108+ (Windows, macOS, Android)
- Safari 16+ (macOS, iOS)
- Firefox 122+ (Windows, macOS, Linux)
- Edge 108+ (Windows, macOS)
For older browsers, passkey options will not appear and users can fall back to password + MFA authentication.
Related Guides
- Authentication Overview — all authentication methods
- Multi-Factor Authentication — use passkeys as MFA
- Email & Password — traditional fallback