Tokens and credentials
Passkey
A phishing-resistant sign-in credential: a key pair, scoped to one website, created and used through WebAuthn.
What Passkey means
A passkey is a FIDO credential — a public/private key pair created by a device or password manager for one website. The site stores only the public key; the user unlocks the private key with a biometric or device PIN to sign a challenge. Because the signature is bound to the site's origin, a phishing site cannot obtain a usable one.
Defined in: W3C Web Authentication (WebAuthn); FIDO Alliance passkey specifications.
How it works
Passkeys use the W3C WebAuthn API in the browser and the FIDO protocols underneath. 'Passkey' is the FIDO Alliance's user-facing name for these discoverable credentials.
Synced passkeys are backed up across a user's devices by the platform or password manager; device-bound passkeys stay on one authenticator such as a security key.
The mistake people actually make
Adding passkeys but leaving an emailed magic link as the recovery path. The account is then exactly as phishable as the email account.
In Authreads
How this applies here
Passkeys are Available for end users on hosted login and through the API, where the tenant allows them, and for operators in the Authreads consoles. Recovery codes are available so a lost passkey does not fall back to an emailed link alone.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Related terms
WebAuthn
The W3C browser API for creating and using public-key credentials such as passkeys and security keys.
Multi-factor authentication (MFA)
Authentication that requires two or more different kinds of evidence — something you know, have, or are.
Hosted login
A sign-in page served by the identity provider, which the application redirects to.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.