Passkeys are revolutionizing online authentication by providing users with a more secure and seamless login experience. However, to fully leverage the potential of passkeys, it's essential to implement intelligence and verification strategies that ensure their correct and efficient usage. In this article, we'll explore the key aspects of passkey intelligence, login identifiers, and verification methods that enhance user experience and security.

Read full, original blog post here

What is Passkey Intelligence?

Passkey intelligence refers to the system's ability to determine when and how passkeys should be used. It ensures that users only encounter passkey authentication when it's available and applicable on their device. This intelligence layer is crucial because passkey availability cannot be directly checked due to privacy restrictions. Instead, systems need to rely on a combination of indicators like LocalStorage, synced passkeys across cloud accounts, and cross-device authentication (CDA).

Key Features of Passkey Intelligence:

1. Smart Passkey Detection: The system checks whether a passkey is available on the user's device through indirect methods. For example, it monitors LocalStorage or detects if synced passkeys are accessible via cloud services or third-party password managers.
2. QR-Based Cross-Device Login: Users can log in from a new device using a QR code and Bluetooth. This feature enhances the convenience of passkey usage, especially when a passkey isn't available on the local device.

These features streamline the user experience, reducing confusion and ensuring that passkeys are presented as an option only when they can be used effectively.

The Role of Login Identifiers

Login identifiers are critical for user authentication, allowing the system to distinguish between different users. Common login identifiers include email addresses, phone numbers, and usernames. In passkey implementations, these identifiers are fed into the passkey intelligence system to determine the best login method for the user.

Why Login Identifiers Matter: Login identifiers simplify the login process by using an identifier-first approach. Instead of a separate "Sign in with passkey" button, users first input their identifier, and then the system intelligently determines the best method of authentication based on available passkeys. This method increases adoption rates for passkeys by reducing friction during login.

Verification Options for Enhanced Security

Verification of user accounts is a critical part of passkey-based authentication systems, ensuring that accounts are legitimate and secure. There are two main components to verification: strategies and methods.

Verification Strategies:

1. None: Accounts are created without verification, which can lead to security issues.
2. At Sign-up: Users must verify their accounts immediately during sign-up. This is the most secure option.
3. Before First Login: Users can create accounts without verification but must verify them before subsequently logging in for the first time.

Verification Methods:

• Email Verification: This method uses either email magic links or one-time passcodes (OTPs) to verify the user's identity. While email magic links can be convenient, they come with potential security risks, such as cross-device confusion or vulnerabilities to social engineering.
• Phone Number Verification: OTPs sent via SMS offer a more convenient alternative to email magic links, especially in multi-device environments.

Custom Authentication Flows

Each application's user base may have different preferences for using passkeys. Therefore, Corbado provides customization options for passkey usage prompts and automatic passkey creation. For example, developers can configure how frequently users are asked to use passkeys or whether passkeys should be created automatically after cross-device authentication. This flexibility helps developers create a balance between user convenience and security.

Conclusion

Passkey intelligence, login identifiers, and verification methods are key parts of a successful passkey implementation. To learn more about how Corbado's solutions can help you optimize your passkey flows, visit our detailed blog post here.