Skip to main content

​
Passkey Creation for MFA User Accounts

MFA users logging in via desktop and mobile browsers follow a standard login flow where they are offered the option to append a passkey.
The blue background indicates product-specific steps, such as a verification code. Passkey creation occurs within the same application flow.
1

Login when user has no passkeys and has activated MFA

  • User enters their identifier (email/username) on the login page.
2

Fallback to traditional login method

  • If no passkey exists for the account, the system falls back to the traditional login method (username and password).
3

Complete configured additional-factor challenge

  • After the first sign-in step, the user completes every additional factor required by the account’s active policy. The benchmark does not prescribe email, SMS, an authenticator app, push, a security key or another specific factor.
4

Passkey append process initiates

  • Once MFA succeeds, the application shows a manual creation nudge that explains the future sign-in benefit.
  • A quality implementation can first open one creation ceremony automatically. If the user cancels it, the manual nudge appears without an error and waits for the user to click Continue before trying again.
5

System passkey-creation sheet appears

  • User authorizes creation with a platform-supported device-unlock method.
6

Passkey creation successful

  • User successfully creates a passkey and it is now linked with the user account for the respective web-app.
7

Redirection to app dashboard

  • User is redirected to the app dashboard.

​
Acceptance criteria

The relying party must define whether a passkey replaces the existing multi-step sign-in or acts as one factor within it. The acceptance criteria preserve either policy; they do not assume a specific MFA method.

​
References