Passkeys & Passwordless Login

Full WebAuthn/FIDO2 implementation with fallback OTP flows, device management UI, and a Keycloak Required Action that nudges existing users to enrol on their next login.

Overview

We implement a complete passwordless authentication experience using the WebAuthn/FIDO2 standard built into Keycloak. Users register passkeys via biometrics (Face ID, Touch ID, Windows Hello) or hardware security keys (YubiKey, FIDO2 USB), with a graceful TOTP fallback for devices that lack a platform authenticator. A self-service device management UI lets users add, rename, and revoke their registered passkeys from the account console. Existing password-based users are migrated via a Keycloak Required Action — a standard mechanism that prompts each user to enrol a passkey on their next login, with no forced password resets or admin intervention required.

Delivery Process

What's Included

• WebAuthn registration flow
• Passkey login flow
• Fallback TOTP flow
• Device management UI
• Passkey enrollment Required Action
• Documentation & runbook

Timeline & Scope

Tech Stack