Passkeys

Players save a passkey after they sign in with an email code, Discord or Steam. Next time they choose Sign in with a passkey and confirm with a fingerprint, face, screen lock PIN or security key.

1. Turn it on for an application

Passkeys are set per application. Open the application in the console, and under Passkeys:

Tick Offer passkeys on the sign-in page.
Optionally tick Let a passkey create a new account (see Passkey sign-up).
Select Save passkey settings.

Project owners and admins can change these settings. Your application code doesn't change: passkeys run entirely on the hosted login page, and your app receives the same tokens as for any other sign-in method.

Passkeys are available for browser and game applications. For a game application they appear on the device approval page and, with passkey sign-up allowed, on the guest upgrade page.

What players see

After signing in with an email code, Discord or Steam, the page asks Sign in faster next time? Players choose Add a passkey or Not now. Either way they then continue to your app as usual.
Next time, Sign in with a passkey appears with the other sign-in methods. The browser lists the passkeys saved for your project, and the player confirms with their device.
The passkey belongs to the same account. Its sub is the same auth4.dev user ID whichever method the player used.
Players who already have a passkey are still offered one when they sign in another way, so they can add one on a new device. A player can have up to 10 passkeys in one project.
Guests can't add a passkey while they sign in. To keep their progress they upgrade: when passkey sign-up is allowed, the upgrade page offers Create a passkey, and the new passkey is saved to the guest's own account.
On the device approval page, players choose Sign in with a passkey (or Create an account with a passkey) and then approve the code as usual. The page doesn't offer to add a passkey after another sign-in method.
If the browser doesn't support passkeys, the option and the offer are not shown.

By default a passkey can only be added to an account that already exists. With Let a passkey create a new account ticked, the sign-in page also shows Create an account with a passkey, and a player can create an account with a passkey alone.

An account created this way has no email address. Its tokens carrysub and no email claim.
It takes effect only while sign-up is allowed for the project. With project sign-up off, the option is hidden.
If the player loses every device that holds the passkey, they can't sign in to that account again. Consider leaving this off unless your game can live with that.

Managing a player's passkeys

On a user's page in the console, the Passkeys section lists their passkeys: when each was added and last used, the application it was added in, and whether the passkey is synced between the player's devices. The console never shows the passkey's public key or credential ID.

A project owner can select Revoke, then Revoke passkey, to stop a passkey from signing in, for example after a player reports a lost device. Revoking a passkey doesn't sign the player out; use Revoke all sessions as well if needed. Both are recorded in the audit log.

How it works

Passkeys are registered to the auth origin, auth.auth4.dev. They work only on the hosted login page, not on your own domain, and a passkey saved on staging doesn't work in production.
auth4.dev stores the passkey's public key, never a private key, and keeps each project's passkeys separate. A passkey from one project can't sign in to another.
Every passkey sign-in requires the player to unlock their device (user verification). Each sign-in uses a new one-time challenge.
If a passkey's sign-in counter goes backwards, the sign-in is refused and an audit event is recorded, because that can mean the passkey was copied.

The endpoints are described in the API reference.

When something goes wrong

If the player cancels the browser prompt, or it times out, the page says so and the player can try again or choose another method.
If the passkey isn't saved for this project, for example because it was revoked, the page asks the player to choose another passkey or sign-in method.
If the passkey option doesn't appear, check that the application has Offer passkeys on the sign-in page ticked and saved, and that the player's browser supports passkeys.