Skip to main content

​
Passkey Creation for Non-MFA User Accounts

Non-MFA users logging in via desktop and mobile browsers follow a standard login flow where they are offered the option to append a passkey.
The blue background indicates product-specific steps, such as a verification code. Passkey creation occurs within the same application flow.
1

Login when user has no passkeys

  • User enters their identifier (email/username) on the login page.
2

Fallback to traditional login method

  • If no passkey exists for the account, the system falls back to the traditional login method (username and password).
3

Passkey append process initiates

  • After an eligible sign-in, the application shows a manual creation nudge that explains the future sign-in benefit.
  • A quality implementation can first open one creation ceremony automatically. If the user cancels it, the manual nudge appears without an error.
4

Passkey append process continues

  • On the manual screen, the user clicks Continue before the ceremony opens. If the relying party’s credential-binding policy requires step-up verification, it is completed before the registration is accepted.
4.a. System passkey-creation prompt appears
  • The browser or operating system asks the user to authorize creation with a supported device-unlock method, such as a biometric or PIN.
4.b. Passkey creation successful
  • The relying party verifies the registration before linking the passkey to the authenticated account.
4.c. Redirection to app dashboard
  • User is redirected to the app dashboard.
5

Skips the passkey append process

  • User skips the optional passkey setup and continues to the app dashboard without an additional factor being introduced by this flow.

​
Acceptance criteria

“Non-MFA” describes the account’s existing sign-in policy. It does not make an email, SMS, or other additional verification step universally required. If the relying party’s binding policy requires step-up verification, that verification must succeed before the new credential is accepted.

​
References

  • Relevant criteria: W2.2-AC01–AC04: How to get high passkey adoption in creation flows covers first-passkey eligibility, manual and automatic post-sign-in creation, and successful enrollment.
  • Relevant criteria: W2.2-AC01–AC03: Passkeys user journeys covers offering passkey creation after sign-in, explaining its future sign-in benefit and using the created passkey later.