Prerequisites
Before you can enable passkeys for a database connection, you must complete the following prerequisites. On your tenant, you must:- Enable Universal Login.
- Enable Identifier First authentication.
- Disable custom login pages. In the Auth0 Dashboard, go to Branding > Universal Login > Manage Classic Login > Login, and disable the Custom Login Page toggle.
- Either disable requiring usernames for your database connection or, alternatively, enable Flexible Identifiers.
- Either disable using your own database or, alternatively, enable user import (Import Users to Auth0). To use your own database without user import (Import Users to Auth0) enabled, follow the additional prerequisites below on updating your database action scripts.
Early Access Use your own database without user import enabled
Passkey authentication now supports using your own database without user import enabled. This lets you offer passkey authentication on custom database connections while continuing to authenticate users against your external user store. As a prerequisite, you must update the Get User and Create database action scripts to support user handling by both identifier anduser_id.
How to update database action scripts to enable passkeys for your own database without user import enabled
How to update database action scripts to enable passkeys for your own database without user import enabled
- First, confirm that user import is disabled for your database connection.
-
Enable context object support. This makes the
contextparameter available in your database action scripts, which is necessary to support both identifier anduser_idlookups. -
The Get User script must support both lookup by identifier (
context.identifierTypeis not set) and lookup byuser-id(context.identifierTypeis set touser_id). Update your Get User database action script fromgetByEmailto the providedgetUserfunction:Example Get User script changes with email attribute enabled -
The Create script must return a valid user profile. When attributes are enabled, the returned user profile must follow the same validation as the Login and Get User scripts. When attributes are not enabled, the returned user profile must include the
user_idvalue. Update your Create database action script to return a valid user profile:Example Create script changes with email attribute enabled
Configure passkeys
Once you complete the prerequisites, you can use the Auth0 Dashboard to enable and configure passkeys.Open passkey configuration
Go to Authentication > Database and select the name of the database connection you want to edit.Select the Authentication Methods tab. Then, in the Passkey section, select Configure to open the Passkey panel.If it isn’t already checked, check Enable passkeys.
Choose passkey authentication UI
The passkey authentication UI determines how users can trigger passkey authentication during login and sign-up.In the Passkey Authentication UI section, choose one of the three options:
If autofill is not available in the user’s browser, users can log in using the passkey button (if enabled) or using password credentials.
| Passkey authentication UI | Description |
|---|---|
| Passkey button & autofill | Users can authenticate with passkeys using autofill or the passkey button. |
| Autofill | Users must log in with their browser’s autofill feature to use passkeys. Autofill allows users to select a saved account from a dropdown menu instead of manually entering their credentials. |
| Passkey button | Users must select the Continue with a passkey button on the login prompt. |
Enable progressive enrollment (optional)
Progressive enrollment prompts users to create a passkey (if they have not done so already) after logging in with an identifier and password. This step is not required and users can choose to delay this action every 30 days.Progressive enrollment can be useful when migrating users to passkeys to help them transition between authentication methods.The Progressive Enrollment checkbox is checked by default, but you can uncheck it to disable it.
When creating an account through an Organization invitation email, users cannot choose passkey authentication. You can enable progressive enrollment so these users can create passkeys after logging in with a password.
Enable local enrollment (optional)
When a passkey user logs in to a new device using a cross-device passkey, local enrollment prompts them to create a local passkey on the new device. This is not required, so users can choose to skip creating a local passkey.The Local Enrollment checkbox is checked by default, but you can uncheck it to disable it.
Next steps
To ensure the best experience for end users when using passkeys, you may want to consider the following additional steps.Configure a custom domain
When a user enrolls a passkey, it associates with the domain. If the domain name changes, any passkeys associated with the old domain become invalid. Consider configuring a custom domain for your tenant prior to enabling passkeys to avoid any interruptions for end-users.If you have Multiple Custom Domains enabled on your tenant, Auth0 maintains a one-to-one relationship between a domain and the passkey for that domain.Users can enroll a passkey for only one domain (the first one they enroll with) of the multiple custom domains on the tenant. For passwordless login, the selected custom domain should be reflected in the Magic Link for the passwordless login flow.