Skip to main content

​
Passkey Creation after Hybrid Login

This approach uses the browser or client platform’s hybrid transport functionality (defined in CTAP 2.2) for secure cross-device authentication. A readiness layer can estimate that cross-device authentication is plausible from server-known credential history, recorded transports and current client capabilities. It cannot inspect the phone’s credential store or guarantee that a usable passkey is present.
Security Requirements: Both devices must have internet connectivity and Bluetooth enabled for cross-device authentication to work. Passkeys are phishing-resistant because the credential is bound to your origin. The Bluetooth exchange adds anti-relay protection on top, requiring the authenticating phone to be physically near the device being signed in to.
1

User enters identifier

  • User enters their identifier (email/username) on the login page in text field.
  • System now knows which user account is attempting to log in.
2

System estimates that cross-device authentication is viable

  • The routing layer combines account metadata and client capabilities to decide whether to offer a cross-device route.
  • This is a confidence-based decision. The operating system performs credential discovery and the relying party does not claim to know what is stored on the phone.
3

Client platform displays the QR route

  • The browser, operating system or client platform displays a screen preparing the user for cross-device authentication.
  • The client platform generates a QR code for secure pairing.
  • Requirements: Both devices must have internet and Bluetooth enabled.
4

User scans QR and authenticates

  • User scans the QR code using their mobile device where the passkey is stored.
  • Bluetooth proximity check: The client platforms establish the required proximity-bound hybrid connection.
  • The mobile device authorizes credential use with a supported device-unlock method.
5

Login completes on current device & passkey append initiates

  • The hybrid exchange returns a normal WebAuthn assertion, and the relying party grants access only after server verification succeeds.
  • A fresh successful assertion from a flow that deliberately offered cross-device authentication can make hybrid use likely. Do not claim definitive transport unless a documented client- or provider-specific signal exposes it.
  • The user can then be asked to add a passkey through the current platform or credential provider.
6

System passkey-creation sheet appears

  • User authorizes creation with a platform-supported device-unlock method.
7

Passkey creation successful

  • User successfully creates a passkey and it is now linked with the user account for the respective web-app.
8

Redirection to app dashboard

  • User is redirected to the app dashboard.

​
Acceptance criteria

This flow turns a completed cross-device sign-in into future passkey coverage on the requesting environment. Its impact is high for these users, but they are only part of the total signed-in population.

​
References