What is passkey authentication?

A login built on the FIDO2 and WebAuthn standards. The customerâs device holds a private key and your site holds the matching public key. To sign in, the customer unlocks the device with a fingerprint, face, or PIN, and the device signs a challenge from your site. No password is typed or stored.

Is a passkey the same as WebAuthn?

Nearly. WebAuthn is the browser standard, FIDO2 is that standard plus the device-side protocol, and a passkey is the credential they produce. Your developer will say WebAuthn. Your customer will see âpasskey.â

Does a passkey count as strong customer authentication?

It can supply two of the three SCA elements. The European Banking Authorityâs 2019 opinion treats a device-bound key as possession and a biometric as inherence. Whether a given transaction counts depends on how your PSP and issuer built the flow, so confirm it with your PSP.

What happens when a customer loses the phone their passkey is on?

If the passkey was synced through Apple or Google, it comes back with the account on the new phone. If it was device-bound, itâs gone, and the customer goes through your recovery flow. The FIDO Alliance recommends registering more than one authenticator so recovery is rarely needed.