---
title: "Passkeys & WebAuthn"
description: "Passwordless, phishing-resistant authentication using FIDO2 WebAuthn Passkeys, Face ID, and Touch ID."
order: 4
category: "Authentication"
updated: "2026-10-13"
---

# Passkeys & WebAuthn

Passkeys provide modern passwordless authentication backed by biometric hardware (Apple Touch ID / Face ID, Windows Hello, and hardware security keys like YubiKeys).

## How AuthSetu Handles Passkeys

1. **Registration**: The browser requests a cryptographic challenge from `/v1/auth/passkeys/register/begin`.
2. **Device Signing**: The user authenticates locally on their device, which signs the challenge using the hardware private key.
3. **Verification**: The public key is sent to `/v1/auth/passkeys/register/finish`, where AuthSetu validates the attestation signature and stores the credential.
4. **Login**: Instant single-touch biometric verification without entering a password.