Setup WebAuthn (Passkey)

What it is used for

Lets the logged-in user register a passkey (WebAuthn credential) as an authentication method. Once registered, the passkey can be used as a 2FA factor and, depending on config, as a passwordless sign-in method.

User flow (what the user will do)

Page path: /[locale]/security/webauthn

Go to WebAuthn security page From the account security page, the user opens WebAuthn / Passkeys.
Register a passkey The user clicks “Add a passkey”. The browser’s WebAuthn API prompts them to use a platform authenticator (Touch ID, Face ID, Windows Hello) or a roaming authenticator (security key, phone).
Confirm on device The user completes the OS/browser prompt (biometric, PIN, or physical key tap). On success the passkey is bound to the account and listed with a name/date.
Manage existing passkeys The user can view registered passkeys and remove ones that are no longer used (lost device, revoked key, etc.).

Supported / not supported methods

This is a compatibility matrix for WebAuthn/passkey authenticators, mirrored with the public client doc: phpreaction.com — application-compte#webauthn . Support depends on the browser + OS combination the user is on, not on this app directly — WebAuthn support is delegated entirely to the browser’s implementation of the FIDO2/WebAuthn standard.

Hardware (roaming authenticators)

Device	Supported
YubiKey (FIDO2/U2F)	✅ Yes
Other FIDO2 security keys	✅ Yes (any certified FIDO2 key)

Operating systems (platform authenticators)

OS	Supported	Notes
Windows	✅ Yes	Via Windows Hello (face, fingerprint, or PIN)
macOS	✅ Yes	Via Touch ID (or password fallback)
iOS	✅ Yes	Via Face ID / Touch ID, synced through iCloud Keychain
Linux	⚠️ Partial	No native platform authenticator UI; requires a roaming hardware key (e.g. YubiKey)
Android	✅ Yes	Via Google Password Manager, screen lock (fingerprint/face/PIN)

Mobile

Platform	Supported
Apple (iOS/iPadOS)	✅ Yes, synced via iCloud Keychain
Android — Google	✅ Yes, synced via Google Password Manager
Android — Samsung	✅ Yes, synced via Samsung Pass

Software (password managers)

Software	Supported
1Password	✅ Yes
Bitwarden	✅ Yes
Others (any FIDO2-compliant credential manager)	✅ Yes, on a best-effort basis

Note: This table should be re-validated whenever the underlying browser/OS support changes — WebAuthn platform support evolves quickly. See tracking issue: phpreaction-frontend-account-react#186 .

How it is implemented

Route: /[locale]/security/webauthn.
Entry point: Account security page -> WebAuthn / Passkeys section.
API flow: relies on the browser’s native navigator.credentials WebAuthn API for registration/assertion; challenge generation and credential storage are handled server-side by the Account API.

For the exact API endpoints, see API Calls.

Account flows index