Passkey Login: Cross-Device via QR Code

This approach uses the browser or client platform’s hybrid transport functionality (defined in CTAP 2.2) for secure cross-device authentication. A readiness layer can estimate that a remote passkey route is viable from account metadata, recorded transports and current client capabilities. It cannot inspect the phone’s credential store or guarantee that a usable passkey is present.

Security requirements: Both devices require internet connectivity and Bluetooth for cross-device authentication. The credential remains bound to the relying-party origin. The Bluetooth exchange provides proximity checking, which reduces the risk that the ceremony is relayed to a remote attacker.

macOS
Windows

User enters identifier

User enters their identifier (email/username) on the login page in textfield.
System now knows which user account is attempting to log in.

System estimates that cross-device authentication is viable

The routing layer uses server-known account metadata and client capabilities to decide whether to offer a remote passkey route.
The browser or client platform performs credential discovery; the relying party does not claim certainty about what is stored on the phone.
When the available evidence strongly indicates a phone route, the product first asks whether the user wants to continue with their phone. It starts WebAuthn only after confirmation where the browser allows the QR flow to be delayed.

Client platform displays the QR route

The browser, operating system or client platform displays a screen preparing the user for cross-device authentication.
The client platform generates a QR code for secure pairing.
Instructions prompt the user to scan the code with their mobile device.
Requirements: Both devices must have internet and Bluetooth enabled.
Where the client supports linked-device reuse, it may offer a previously linked phone on later sign-ins without a new QR scan. Bluetooth is still required.

User scans QR and authenticates

User scans the QR code using their mobile device where the passkey is stored.
Bluetooth proximity check: The client platforms establish the required proximity-bound hybrid connection.
The mobile device authorizes credential use with a supported device-unlock method.

The hybrid exchange returns a normal WebAuthn assertion to the requesting client.
The relying party verifies the assertion and grants access only after verification succeeds.

Acceptance criteria

Benchmark as	User reach
Conditional	Mid

Cross-device authentication extends passkey coverage, but its prerequisites and higher interaction cost make it a conditional route rather than a universal default.

ID	Level	Acceptance criterion	How to verify
W1.4-AC01	Core	When registration returns transport hints for a credential, store them and include the same set in its account-scoped `allowCredentials` descriptor. In particular, retaining `hybrid` lets the browser recognize that the credential may be reached through a phone or QR route. Do not remove or replace recorded transports with guessed values.	Register credentials that report `internal`, `hybrid`, `usb` or other transports. Compare the stored values with each authentication request and confirm that every descriptor retains the same set. On a supporting client, a descriptor containing `hybrid` can offer the phone or QR route.
W1.4-AC02	Quality	When the entered account and current client make cross-device authentication very likely, prepare the user before starting WebAuthn. For example, on Windows, an account whose recorded credentials only indicate `hybrid` mobile routes can be asked whether they want to sign in with their phone. Show the QR route only after the user confirms, where the browser allows this flow to be delayed.	Submit an account whose recorded transports strongly indicate a phone route and another account with a likely local credential. Only the first receives the phone preparation step. No WebAuthn prompt or QR appears before confirmation, and declining leaves another login route available.

References

Relevant criteria: W1.4-AC01: W3C Web Authentication Level 3 defines the hybrid transport and recommends retaining known transports in credential descriptors.
Relevant criteria: W1.4-AC01–AC02: Corbado: WebAuthn passkey QR codes and Bluetooth supports transport-aware cross-device routing and preparing users for the phone route. Its benchmark ranges are not acceptance thresholds.

Overview

Web

Native

Passkey Login: Cross-Device via QR Code

Acceptance criteria

References

​Login via Mobile Device (Cross-Device Authentication)

​Acceptance criteria

​References

Login via Mobile Device (Cross-Device Authentication)

Acceptance criteria

References