Skip to content

Register a passkey

Add a passkey to your own account, so you can sign in with this device's screen lock, a password manager or a security key instead of typing a password.

Who can do it

Any person who signs in, for their own account. No role or permission is needed: the account is the one you signed in with, and no administrator can add a passkey on your behalf.

The console offers no passkey form when:

  • you are acting in a tenant under support access: the Security item is absent from the account menu, and the page manages nothing;
  • your session came from your organization's identity provider and the platform holds no credential for you: the page says that the identity provider manages your credentials;
  • the server states that no passkey would serve any of your sign-ins, for example because every tenant you belong to signs you in through its identity provider.

Before you start

  • Open the console on the deployment's host name. On the host's IP address a passkey cannot be created or used: the form is shown, but adding the passkey is refused.
  • Use a browser that supports passkeys, and a page certificate the browser trusts. Accepting a certificate warning is not enough.
  • Check what the tenant you are signed in to requires. When it requires a hardware-backed, attested or device-bound passkey, one that cannot prove it is refused. The requirements of your other tenants are not checked when you add it.

Steps

  1. Open the account menu in the header and select Security.
  2. Under Passkeys and authenticator app, find Add a passkey.
  3. In Passkey name, type a name you will recognize later, such as Work laptop. The name is up to 100 characters.
  4. Select Add passkey.
  5. Complete the request your browser or device shows: your fingerprint, face, screen lock, password manager or security key.
  6. If Confirm your identity to continue opens, confirm with your own sign-in steps. Nothing has been added yet; once you confirm, the console continues.
  7. If this is your first passkey or authenticator app, the console shows Save your recovery codes. Store them away from the device that holds the passkey, select I have saved these codes somewhere safe, then Done.

What you see when it worked

The console says "Passkey added." and the passkey appears in the list under its name, with the date it was added, "Never used", and what it establishes: phishing-resistant, verifies you on every use, syncs to your other devices or bound to one device, hardware-backed, attested by its maker, discoverable. A property the device did not report shows "Not reported".

The passkey serves every tenant you belong to whose sign-in requirements admit it. The change is listed under Recent security activity.

If it fails

What you see Cause What to do
"The browser did not complete the passkey request." with its likely causes The page certificate is not trusted by the browser, or the request was cancelled or timed out Open the console on a certificate the browser trusts, then try again
"This browser cannot create passkeys. Use a browser that supports them." The browser has no passkey support Use another browser
"Your device could not create the passkey. Nothing was added. Try again." The device ended the ceremony with an error Try again, or use another authenticator
"The passkey could not be verified, so nothing was stored. Add it again." The server could not verify what the device returned Add it again
A refusal saying the passkey lacks a property a tenant requires The tenant you are signed in to requires a property this passkey cannot establish Use an authenticator that has it, for example a hardware security key
"Passkeys are unavailable on this origin: it is not the deployment's Management host name" The console is open on the host's IP address Open the console on the deployment's host name
"Give the passkey a name of up to 100 characters." The name is empty or too long Correct the name
"This session cannot be used for this change. Sign in again, then repeat it." The session does not identify itself to the server Sign in again and repeat the change
"This change requires you to confirm your identity again. Nothing was changed." The confirmation was closed or did not succeed Repeat the change and confirm your identity

Without the console

Surface How
API POST /api/v3/auth/account/authenticators/passkeys/registration-options (operation createPasskeyRegistrationOptions), then the browser ceremony, then POST /api/v3/auth/account/authenticators/passkeys (operation registerPasskey)