Documentation
Getting started
Self-hosting
Concepts
Sign-in methods
Organizations & teams
Enterprise SSO & SCIM
Customization
Security
Integrations & operations
For AI agents

Passkeys (WebAuthn)

AdminUpdated Sep 11, 2026

Passkeys (WebAuthn)

Passkeys let users sign in with the biometric or PIN on their device — Face ID, Touch ID, Windows Hello — or a hardware security key. They're built on the WebAuthn standard, are phishing-resistant by design, and never send a shared secret over the wire.

Why passkeys

  • No password to steal, phish or reuse. The private key never leaves the device.

  • Great UX. A glance or a touch, and the user is in.

  • Synced across devices via the user's platform (iCloud Keychain, Google Password Manager), so they aren't locked out on a new phone.

Enable passkeys

  1. Sign-in methods → Passkeys → toggle on.

  2. Ensure your instance has a proper domain configured (WebAuthn is bound to a domain — see Custom domains for Production).

Enrolling a passkey

Users add a passkey after signing in, from your account UI or the hosted account page:

  1. The user chooses Add a passkey.

  2. The browser prompts for the device biometric / PIN.

  3. Atlas stores the resulting public key credential against the user.

A user can register multiple passkeys (phone, laptop, hardware key).

Signing in with a passkey

On the sign-in page the user selects Sign in with a passkey; the browser presents matching credentials and verifies the user locally. Atlas checks the signed challenge and issues a session.

Passkeys as a second factor

Passkeys can also serve as a strong MFA second factor on top of a password or code. See Multi-factor authentication.

Good practice

  • Offer passkeys alongside a recoverable method (email code) so a user who loses all devices can still get in.

  • For high-value accounts, encourage at least two passkeys on separate devices.

Next

For web3 apps, let users sign in with their wallet → Web3 & SIWE.

Was this page helpful?