MFA-Passkeys (FIDO2 / WebAuthn)

• Scope
• I am new. Where should I start?
• Purpose
• Prerequisites
• I already understand. How do I proceed step by step?
• Sign-in flow with passkey
• Security motes
• Troubleshooting
• Summary

Purpose

• Eliminating shared secrets (no codes to steal)

• Binding authentication to a specific device

• Leveraging FIDO2 / WebAuthn standards

• Phishing attacks

• Credential reuse

• Man-in-the-middle attacks

Prerequisites

• Your account is created and signed in

• Multi-Factor Authentication (MFA) is enabled

• Your device supports:

  • Biometrics (Face ID, Touch ID, fingerprint), or

  • Secure screen lock (PIN / pattern)

• You are using a supported browser

I already understand. How do I proceed step by step?

Step 1: Enable Multi-Factor Authentication

1. Go to Account → Security

2. Turn on Multi-Factor Authentication

Step 2: Set up passkey

1. In Security → Multi-Factor Authentication

2. Select Passkey

3. Click Set up passkey

4. Click Create passkey

Step 3: Verify your identity on device

1. Click Continue

2. Follow the on-screen instructions provided by your device:

   • Face ID / Touch ID

   • Device PIN or screen lock

Step 4: Passkey created successfully

• Your passkey is registered

• MFA using passkey is now active

Sign-in flow with passkey

1. Enter your email and password

2. Passkey is selected as the default verification method

• Click button Continue

• Verify your identity using a registered passkey.

• ✅ Sign-in completes automatically after successful verification.

Security motes

• Passkeys are phishing-resistant

• No verification codes are generated or transmitted

• Private keys never leave your device

• Each passkey is bound to a specific device

• You can remove a passkey from Security settings at any time

Troubleshooting

• Use Email MFA or Authenticator App (if enabled)

• Register a new passkey on your new device

• Ensure your browser and OS are up to date

• Make sure device lock or biometrics are enabled

Summary