Passkey
A passkey is a passwordless MFA login method based on public-key cryptography and the WebAuthn standard. It lets your users log in to their Signicat IAM (SIAM) user profiles using the screen locks on their devices, such as a fingerprint, facial recognition, PIN or pattern.
What is passkey authentication?
In SIAM, a passkey replaces the username, password and TOTP code during login. The user does not enter a password before using the passkey.
When a user registers a passkey, their passkey provider creates a cryptographic key pair:
- The private key remains protected by the user's device, browser, password manager or security key.
- The public key is associated with the user's SIAM profile and is used to verify a signed login challenge.
The user unlocks the private key with their device screen lock. Their biometric data or device PIN is verified locally and is not used as the SIAM credential.
Why use passkeys?
Passkeys provide a quick login experience without requiring users to remember a password or type a TOTP code. Each passkey is associated with the website for which it was created, which prevents a fraudulent website from using it. The login also uses a unique cryptographic challenge, which prevents an intercepted response from being replayed later.
Passkeys are useful when you want to:
- Reduce password-related support and recovery requests.
- Provide passwordless multi-factor authentication (MFA).
- Provide a streamlined login experience across supported devices.
- Protect your users against phishing and credential replay.
- Avoid sending a shared secret during passkey login.
Your SIAM administrator must enable passkeys in SIAM settings before your users can register or use one. The Passkey section and Sign in with passkey button are only displayed when passkeys are enabled.
End-user journeys
This section describes how your users can:
- Register a passkey for their SIAM user profiles.
- Log in using a passkey.
- Remove a passkey from their profiles.
How to set it up
To register a passkey, a user:
- Logs in to your SIAM platform, then clicks their user icon in the top navigation bar.
- From the dropdown menu, selects Manage profile. They are now on the Personal info page.
- In the Passkey section, clicks Add passkey.
- Enters their current password and a unique name for the passkey.
- Clicks Continue.
- Follows the instructions from their browser, operating system or security key to create and save the passkey.
- After they return to SIAM, confirms that the Passkey added dialog is displayed.
A user can register more than one passkey. They should give each passkey a name that helps them identify the device or provider where it is stored.
How to log in
To log in using a passkey, a user:
- Goes to your SIAM platform URL.
- Clicks Sign in with passkey.
- Selects the passkey that they want to use, if prompted.
- Follows the instructions from their browser, operating system or security key to verify their identity.
If the passkey is stored on another device, the user's browser might offer a QR code or another cross-device option. The user follows the instructions displayed by their browser and the device where the passkey is stored.
If a user cannot use their passkey, they can return to the login page and log in with their username or email address and password.
How to remove a passkey
To remove a passkey from their profile, a user:
- Logs in to your SIAM platform, then clicks their user icon in the top navigation bar.
- From the dropdown menu, selects Manage profile. They are now on the Personal info page.
- In the Passkey section, clicks the bin icon beside the passkey that they want to remove.
- Enters their current password, then clicks Remove.
Removing a passkey from SIAM does not necessarily remove the saved credential from the user's device or password manager. They can also delete it there if they no longer need it.