https://duendesoftware.com/blog/20250930-introduction-to-passkeys-the-future-of-authentication/

[giscus[bot]]

https://duendesoftware.com/blog/20250930-introduction-to-passkeys-the-future-of-authentication/

We help companies using .NET to build identity and access control solutions for modern applications.

https://duendesoftware.com/blog/20250930-introduction-to-passkeys-the-future-of-authentication

[spingee]

If i register on one device with windows hello , i can only login from that device? What if i want to login from ipad with touch id for example?

[maartenba]

@spingee The passkey has to be synchronized somehow. The Windows Hello / Microsoft Account-linked passkey wuill typically be available on all your Windows devices, and macOS has similar infrastructure.

Cross-OS will typically be stored in the browser (e.g. Chrome is an authenticator and can sync across Chrome browsers on your devices) or in a password manager like 1Password.

[promim]

Would you recommend declaring a custom authentication scheme for when it's time to do HttpContext.SignInAsync() after successful passkey authentication, or just use the default idsrv scheme in IdentityServer?

[maartenba]

The default should be good, and this would work similar to e.g. 2FA in ASP.NET Identity with IdentityServer.

[promim]

Thanks, I've avoided ASP.NET Identity in my implementation and just used fido2-net-lib with the default idsrv scheme for sign-in upon credential authentication. I guess a custom scheme is needed mostly for scenarios when logging in with external IdPs as it stands.

[maartenba]

Exactly. To use passkeys as a 2nd factor having the additional scheme (or other way to persist what is effectively session state) will make sense. This week's post (due tomorrow) will also have a short note on schemes (and how MS did it in ASP.NET Identity). Stay tuned!

[maartenba]

@promim Just published - https://duendesoftware.com/blog/20251007-passkeys-in-dotnet-10-blazor-apps-with-aspnet-identity
Find "Wait a minute!" for some pointers on how MS do this.

[nikriaz]

Okay, I understand that Microsoft has implemented this in their Net.Identity but how passkeys are related to the Identity Server, OAuth, BFF and all these stuff what we use? How to replace password flow with passkey flow? What would be then a auth flow for a SPA, for example?

[maartenba]

We'll cover some of that in post 4 of the series. The login page you currently have (when using IdentityServer backed by ASP.NET Identity) will support username/password + external providers, and we'll see how to add passkey support in there as well. You could replace username/password with only passkeys as well if that is desired.