> For the complete documentation index, see [llms.txt](https://docs.authgear.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.authgear.com/authentication-and-access/authentication/passkeys.md). # Add Passkeys Login Passkeys give users a simple and secure way to sign in to your apps and websites across platforms without passwords. Passkeys replace passwords and other passwordless login methods. They are built on WebAuthn, part of the FIDO2 standard, which uses public key cryptography to authenticate the user. #### Platform support and multiple devices Passkeys are supported by current versions of the major browsers and operating systems, including iOS 16 and macOS 13 (Ventura) or later, and Android 9 (API level 28) or later. See [passkeys.dev](https://passkeys.dev/device-support/) for the full list. Passkeys sync through the platform's password manager, such as iCloud Keychain or Google Password Manager, so users can sign in on all their devices. Users confirm a sign-in with the device's screen lock, such as Face ID, Touch ID, Windows Hello, or an Android fingerprint or face unlock. #### Hardware security keys Passkeys can also be stored in hardware security keys such as [YubiKeys](https://www.yubico.com/blog/passkeys-and-the-future-of-modern-authentication/), which provide the highest security against attacks. ## Add Passkeys to your apps with Authgear To enable passkeys: 1. In your project portal, go to **Authentication > Login Methods**. 2. In the **Passkey** section, turn on **Enable passkey support for compatible devices.** 3. Press **Save**. In the same section, **Show "Don't ask me again" option on the passkey upsell screen** lets users opt out of future reminders to create a passkey. A user who opts out can still create one in their account settings. {% hint style="info" %} Keep another login method enabled, such as **Password** or **Passwordless**, for users whose devices or browsers do not support passkeys. To use only passkeys, select **Custom**, and in the **Custom Login Methods** tab keep at least one Login ID active and deactivate every authenticator. Keep **Enable passkey support for compatible devices.** turned on. {% endhint %} ## Use passkeys in your iOS or Android app When your mobile app shows the Authgear UI in its own WebView instead of the system browser (see [Using WebView to open the Authgear UI](/integration/mobile-apps/using-webview-to-open-the-authgear-ui.md)), the operating system allows passkeys only for apps that your project lists. Authgear publishes the listed apps in `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` on your project's domain. Apps opening the Authgear UI in the system browser need none of this. {% hint style="warning" %} List only apps you control. A listed app controls everything shown in its WebView, including the Authgear UI, and can request your users' passkeys. {% endhint %} ### List your apps 1. In your project portal, go to **Applications** and open your Native App application. 2. In the **Associated apps** section, press **Add iOS app** or **Add Android app**. 3. Enter the app's details: * **iOS:** the Team ID from your Apple Developer account, and the Bundle ID. * **Android:** the package name, and the SHA-256 fingerprint of every certificate the app is distributed with, one per line. 4. Press **Save**. An app can be listed only once, across all applications in the project. A listed app can use passkeys whichever application it signs in with. ### iOS Add the entry shown under **iOS Associated Domains entry**, `webcredentials:`, to the Associated Domains capability of your app in Xcode. Apple fetches `apple-app-site-association` through its own CDN, so a change can take time to reach devices. To test a change sooner, append `?mode=developer` to the entry, for example `webcredentials:auth.example.com?mode=developer`. Apple then fetches the file directly, but only for a development-signed build on a device with Developer Mode turned on. Requires iOS 16 or later. ### Android * **Include the Play App Signing certificate.** An app installed from Google Play is signed with it, not with your upload certificate. Find its fingerprint on the **App signing** page in Google Play Console. A build signed with a certificate you have not listed cannot use passkeys. * **List a debug certificate only in a project used for development.** A debug keystore has a well-known password, so anyone who obtains it can sign an app that passes as yours. * **Do not declare a verified intent filter for your project's domain.** The association file also lets a listed app open links on that domain, including the Authgear UI and links in emails, if the app declares a verified intent filter for it. Check the app's merged manifest, because a library can add one. Requires an Android System WebView that supports WebAuthn, and Google Play services 24.07 or later. On other devices, users sign in with your other login methods. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.authgear.com/authentication-and-access/authentication/passkeys.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.