fluentAuth
★ 4.0 · 10k+ installsGet FluentAuth
Docs / Login security

Passkeys

Set up domain-bound passkey verification with a device, security key or password manager.

All documentation
Getting started
IntroductionInstallationGuided setupFirst-day setupThe dashboard
Login security
Limit login attemptsTwo-factor authenticationPasskeysIP access rulesCore security settings
Passwordless & social login
Magic loginSocial loginLogin with GoogleLogin with GitHubLogin with FacebookGoogle One-Tap
Forms & redirects
ShortcodesLogin redirectsLogin page designerSystem emails
Monitoring & recovery
Audit logsNotifications and digestsFile integrity scanningSecurity findingsRecovery after a compromise
Reference
Settings referenceHooks and filtersConstantsRemote auth (server mode)Troubleshooting

FluentAuth supports direct passkey sign-in without entering a username or password. Users can sign in with Touch ID, Windows Hello, a compatible password manager or a security key. The browser binds the credential to your site’s domain; a copied login page on another domain cannot request it.

Passkey, authenticator app and email code options in FluentAuth settings.
Device methods are configured separately from the email fallback.

Requirements

  • Serve the site over HTTPS. Localhost is supported for development.
  • Use a browser and device that support WebAuthn.
  • Your server needs PHP’s OpenSSL signature verification support.
  • Keep a recovery route available before relying on a passkey.

Enable passkeys for a role

  1. Open FluentAuth → Settings → General Settings → Two-Factor Authentication.
  2. Enable Passkey and choose the roles allowed to set one up.
  3. Save. An empty role list does not enable passkeys for anyone.

Register your own device

Open Users → Profile → Passkeys. Enter a label under Name this device, select Add a passkey, and complete the browser’s device verification. You can only register credentials for your own account. Administrators can remove a credential for a user who needs help recovering access; they cannot register a replacement on that user’s behalf.

Keep a fallback

A single passkey without a fallback is not enough for FluentAuth to start challenging an account. Keep unused recovery codes, an enrolled authenticator app, or a second registered passkey. Prefer a recovery method you can access if your primary device is unavailable.

This matters even for a synced passkey: losing access to the account that syncs it can affect all of its copies. See two-factor recovery.

At sign-in

On the login page, select Log in with passkey without entering a username or password. Your browser or password manager finds the saved passkeys for the site. Choose your account and approve the device prompt to sign in. This is discoverable passkey sign-in: the saved credential identifies your account.

Passkeys can also serve as device verification after another sign-in method. For an eligible user with a usable passkey and fallback, FluentAuth offers passkey verification before the authenticator app. A magic link proves the mailbox; it does not satisfy a required device factor.

Moving domains and troubleshooting

Passkeys are bound to the site domain. A staging copy on another domain cannot reuse your production credentials. After a domain change, use a working fallback and register new passkeys for the new site.

If Add a passkey is unavailable, check HTTPS, browser support, the enabled method and your role. If a registered passkey is not requested, check that a fallback exists and the method is still enabled for your role.