Passkey Creation: After Login of Non-MFA Account (post-login nudge)

Passkey Creation for Non-MFA User Accounts

After a conventional sign-in to a single-factor account, the app can offer the account’s first passkey.

iOS
Android

Blue steps in the diagram are product-specific and are not part of the passkey benchmark.

User enters their identifier (email/username) on the login page.

Fallback to traditional login method

If no passkey exists for the account, the system falls back to the traditional login method (username and password).

Passkey append process initiates

After the eligible sign-in, show a manual nudge that explains how a passkey improves the next sign-in.
A quality implementation can first open one creation ceremony automatically. If it is cancelled or fails, show the manual nudge without an error.

Passkey append process continues

The user clicks Continue before the manual flow starts a creation ceremony. If the relying party’s credential-binding policy requires step-up verification, it is completed before registration is accepted.

4.a. System passkey-creation sheet appears

The platform asks the user to authorize creation with a supported device-unlock method.

4.b. Passkey creation successful

The relying party verifies the registration before linking the passkey to the authenticated account.

Skips the passkey append process

The user skips the optional passkey setup and continues to the app.
After the configured limit of cancelled or failed attempts, the app also continues without another prompt or error.

Acceptance criteria

Benchmark as	User reach
Strategy	High

This flow covers the first-passkey nudge after a successful non-passkey sign-in to a single-factor account.

ID	Level	Acceptance criterion	How to verify
N2.1-AC01	Core	Show this flow only after a successful non-passkey sign-in to a single-factor account on a client that can create a passkey, when the account has no registered passkey.	Test successful, failed and abandoned conventional sign-ins, a passkey sign-in, an MFA account, an account with a passkey and an unsupported client. Only the eligible single-factor account enters this flow.
N2.1-AC02	Core	After the eligible sign-in, show a manual creation nudge that explains how a passkey improves the next sign-in, unless a passkey was already created by the automatic ceremony in N2.1-AC04. The user can continue to creation or continue to the app without a passkey.	Complete an eligible sign-in. Confirm that the nudge explains the future sign-in benefit, Continue opens one creation ceremony, and skipping continues without creating a passkey. One automatic ceremony under N2.1-AC04 does not fail this criterion.
N2.1-AC03	Core	The created passkey is stored for the authenticated account and can complete a later passkey sign-in to that same account.	Complete creation, sign out and use the new passkey to sign in again. The assertion resolves to the same account.
N2.1-AC04	Quality	On suitable clients, open one creation ceremony automatically after the eligible sign-in. If it is cancelled or fails before the configured attempt limit is reached, show the manual nudge without an application error and wait for the user to choose another attempt. Once the limit is reached, continue silently without another ceremony, nudge or error.	Cancel or fail the automatic attempt below the limit and confirm that the manual nudge appears without an error or immediate reopen. Reach the limit and confirm that the signed-in journey continues without another ceremony, nudge or error.

References

Relevant criteria: N2.1-AC01–AC04: Corbado: How to get high passkey adoption in creation flows covers post-sign-in eligibility, manual and automatic creation, retry limits and successful enrollment.
Relevant criterion: N2.1-AC01: Corbado: Passkey fallback and recovery covers the distinction between single-factor and MFA account journeys.
Relevant criteria: N2.1-AC01–AC03: Google: Passkeys user journeys covers creation after sign-in, benefit framing and later use.

Overview

Web

Native

Passkey Creation: After Login of Non-MFA Account (post-login nudge)

Passkey Creation for Non-MFA User Accounts

Acceptance criteria

References

​Passkey Creation for Non-MFA User Accounts

​Acceptance criteria

​References

Passkey Creation for Non-MFA User Accounts

Acceptance criteria

References