Passkeys (WebAuthn)

Register passkeys for your operator account. Sign in with Face ID, Touch ID, or a security key instead of pasting JWTs manually.

Console

Settings → Identity (/settings/identity)

1. Register passkey → browser WebAuthn prompt.
2. List registered credentials (created date, device hint).
3. Remove stale credentials.

SSO/SAML and SCIM provisioning live on the same Identity page.

Flow

1. POST /webauthn/register/options → browser credential creation.
2. POST /webauthn/register/verify → store credential in D1 (webauthn_credentials).
3. Login: POST /webauthn/login/options → POST /webauthn/login/verify → member JWT issued.

Environment

Must match the dashboard hostname exactly in production (no mismatch between Vercel preview and Worker config).

Self-host

Configure Worker env to match your dashboard URL. See optional integrations for hosted beta defaults.

Related

• Session security
• Identity settings