Passkeys

A passkey is a pair of keys. The private key stays with you and never leaves your authenticator. Identity holds only the public key. To sign in, identity sends a random challenge, your device signs it with the private key after checking you, and identity verifies the signature with the public key. A challenge is 32 random bytes, valid for 5 minutes by default (an operator can shorten that, to no less than 30 seconds), and used once. A copy of identity's database contains nothing that can sign in.

The signature is bound to the site. A fake page on another domain cannot ask your authenticator for a passkey that belongs to the real one, so a phishing page gets nothing it can reuse.

When you add a passkey, identity asks your device for a discoverable credential and requires that you verify yourself on the device.

Identity accepts the algorithms EdDSA, ES256 and RS256.

On the sign-in page you can select Sign in with a passkey, or click into the email field: your browser may offer a saved passkey there. Approve the prompt. A passkey sign-in does not ask for a separate second step, because the passkey already includes the device check.

If the browser cannot use passkeys the page says This browser cannot use passkeys here. Use another method. If it does not work, it says The passkey did not work. Try again or use another method.

You can have several passkeys, for example one per device or a security key as a spare. In your account, under Security and Passkeys, you can add one, optionally with a Name for this passkey, rename it or remove it. The full steps are on Security and passkeys.

Identity also offers a passkey after a password sign-in, where the deployment makes the offer. The offer is titled Add a passkey, and Skip for now hides it for 7 days.

A passkey is an addition to a password, not a replacement for one. If your account has no password yet, a passkey sign-in asks you to Choose a password before it finishes.

Removing a passkey is a sensitive change. It asks you to confirm with a second factor, signs your other devices out and sends you a security alert. Identity refuses to remove your only way to sign in. If it is your only method, add another passkey or set a password first.

A passkey is bound to a relying party id, which is a domain name, when it is created. Identity's relying party id is the shared parent domain tdacorp.in and not a single product's subdomain. Sign-in is allowed only from an exact list of identity's own origins. Because every TDACorp product signs in through identity, one passkey works across all of them, and a product that has its own subdomain never needs its own enrolment.

That depends on the type, which is the subject of Synced and hardware passkeys. In short: a passkey in a password manager or a platform keychain can be copied to your other devices, while a passkey on a security key stays on that key.

• Lost passkey. If a passkey is your only second step and you still know your password, the second step offers Email me a code instead: an emailed code that signs you in one level lower than a passkey, tells your other addresses and still leaves some apps asking for your passkey. See The second step.
• Recovery. If you lose every passkey and have no other way in, use account recovery. See The recovery model.
• Another browser. On a device that does not have your passkey, use another passkey, such as a security key, or another method.

• Authentication methods
• Assurance levels
• Signing in