Passkey Management

Create, manage or delete Passkeys via Passkey List Component

Passkey management lets users view and revoke passkeys registered to their account. The server-side list shows which credentials the relying party accepts. Provider-side copies may remain until the credential provider acts on best-effort reconciliation.

General Passkey Management

General Passkey Settings in Profile Section

Users can see all the passkeys created for the current account here.
Each entry shows the authenticator or passkey-provider name resolved from the AAGUID stored during registration. If no trusted mapping exists, the entry uses a neutral name instead of guessing.
Users can initiate passkey registration in the current browser through its active credential provider.
Users can revoke an existing credential and, where supported, edit an RP-side friendly label. The cryptographic credential itself is not updated.

When no Passkey is created for the User Account

When the user has no passkey created, the passkey list is shown empty.

Passkey Delete Modal

Provide a clearly named revoke or remove action associated with the selected passkey.
This action is not reversible, so the user is again asked for confirmation on deletion of passkey.
Revoke the credential in server state so every later assertion from it is rejected. Then send best-effort Signal API reconciliation so the credential manager can hide or remove its stale client-side copy.
User has the possibility to create a new one.

Server revocation completes the security action, but not the credential-manager cleanup. The stale passkey may keep appearing in Conditional UI and the account chooser until the credential manager acts on a signal. The user can select the stale passkey and complete device authorization, but the server rejects the assertion and login fails. This can make the settings screen appear broken. Call signalAllAcceptedCredentials from the revoke action, but treat signalling as best-effort because providers may hide, remove or ignore the credential. See the WebAuthn Signal API.

Passkey List Error States

Passkey List Loading Error

The list of passkeys fails to load (e.g., due to network or system error).

User aborts Passkey Creation

User cancels creation during system prompts or internal dialogs. No new passkey is added in the list.

Passkey Creation failed due to API Errors

User experiences errors from backend/API during passkey creation. The error is communicated clearly.

Passkey Deletion fails

Deletion of the passkey returns an error due to system or API failure.

Passkey already exists

Attempting to register a passkey that is already present prompts an informative error.

No Passkey Support

When the client cannot create a passkey, omit or disable only the add action with an accurate explanation. Keep the server-side list and revoke actions available.

Acceptance criteria

Benchmark as	User reach
Baseline	Low

Low user reach does not mean low importance. Passkey management is a baseline lifecycle and security capability: it gives users control over registered credentials and protects account continuity when a credential is lost or no longer trusted.

ID	Level	Acceptance criterion	How to verify
`W3.1-AC01`	Core	The passkey list contains every credential the server accepts for the current account.	Compare the rendered list with server records for accounts with zero, one and several credentials, including a credential created on another client.
`W3.1-AC02`	Core	Revoking a selected credential changes only that server record and causes every later assertion from it to be rejected.	Give one account several credentials, revoke one, then authenticate with each. The revoked credential fails and every other active credential still works.
`W3.1-AC03`	Core	Confirmed revocation invalidates first-party One-Tap, last-used or availability hints that depend on the revoked credential.	Delete the hinted credential, then start the next login; no personalization or availability decision relies on that credential.
`W3.1-AC04`	Core	Deletion copy describes server-side revocation without promising that a credential provider will remove the private key or its local entry.	Review the confirmation and success copy; it may describe best-effort provider cleanup but does not claim that local removal occurred.
`W3.1-AC05`	Core	After a deletion attempt, the displayed list matches server state before presenting a final result or retry.	Test confirmed deletion, confirmed non-deletion and response loss after a server update. The entry is removed, retained or resolved by reading the current server state.
`W3.1-AC06`	Core	Revoking one credential does not clear valid first-party login hints for unrelated credentials or accounts.	Revoke the hinted credential while another credential and another account retain valid hints; only state that depends on the revoked credential is removed.
`W3.1-AC07`	Quality	Each entry shows a recognizable authenticator or passkey-provider name resolved from the credential’s stored AAGUID when a trusted mapping is available. An unknown or generic AAGUID uses a neutral label instead of guessing the provider, physical device or exact storage location.	Register credentials with known AAGUIDs from different authenticators or passkey providers and one unknown AAGUID. Confirm that the known entries show the mapped names and the unknown entry uses a neutral label.
`W3.1-AC08`	Quality	After confirmed server deletion, a client that supports credential-list reconciliation receives the current complete accepted-credential list.	Delete a credential on a supporting client and inspect the reconciliation call; its list matches the server state after deletion.

References

Relevant criteria: W3.1-AC04 and W3.1-AC07: Google passkey user journeys supports distinguishable entries and accurate deletion language.
Relevant criterion: W3.1-AC07: FIDO Metadata Statement defines AAGUIDs and human-readable authenticator or passkey-provider names intended for display to users.
Relevant criteria: W3.1-AC01, W3.1-AC04 and W3.1-AC07: FIDO Alliance: Build vs. Buy: A Guide to Deploying Passkey-Based Authentication supports complete credential lists, useful metadata and server-side deletion.
Relevant criteria: W3.1-AC01–AC02: NIST SP 800-63B: Authenticator Event Management supports account-scoped authenticator records and targeted revocation.
Relevant criteria: W3.1-AC01–AC02: Web Authentication Level 3: Decommissioning supports server-side revocation and rejection of later assertions.
Relevant criteria: W3.1-AC04 and W3.1-AC08: Corbado: WebAuthn Signal API explains the separation between server-side revocation and optional credential-provider cleanup.
Relevant criteria: W3.1-AC03 and W3.1-AC05–AC06: These criteria keep first-party passkey hints consistent with server revocation and resolve response loss without changing an unrelated credential or account.

Overview

Web

Native

Create, manage or delete Passkeys via Passkey List Component

General Passkey Management

Passkey List Error States

Acceptance criteria

References

​Create, manage or delete Passkeys via Passkey List Component

​General Passkey Management

​Passkey List Error States

​Acceptance criteria

​References

Create, manage or delete Passkeys via Passkey List Component

General Passkey Management

Passkey List Error States

Acceptance criteria

References