Passkey Creation: During Sign-Up

This strategy offers passkey creation while a new account is being registered. It can establish passkey use from the first session, but it reaches only new accounts and should be combined with enrollment routes for existing users.

The blue background represents product-specific account verification or activation, not WebAuthn. If the signup method already provides enough assurance to add a passkey, creation can happen before a separate fallback is verified. The credential remains attached to the pending account until every required signup step succeeds.

Start account registration

The user provides the information required to create the account.
The product collects the fallback or recovery method required for the selected authentication setup.
The application creates or reserves the account that the passkey will belong to.

Offer passkey creation

The application starts passkey creation as soon as the completed signup steps provide enough assurance to add the credential.
Registration options are generated for the new account.
The user can continue with passkey creation or skip it when creation is optional.

Complete passkey creation

The browser or operating system asks the user to authorize creation with a supported device-unlock method.
The server verifies and stores the credential for the new account before showing success.

Finish registration

The user completes any remaining account verification, fallback verification or activation required by the product.
An email address or phone number intended for fallback is usable only after its OTP or verification link succeeds.
If passkey creation was skipped or cancelled, registration continues without a passkey and another creation route can be offered later.

Acceptance criteria

Benchmark as	Expected adoption impact
Strategy	Mid

This flow covers passkey creation as part of registering a new account. Its reach is high among new users but does not enroll existing accounts.

ID	Level	Acceptance criterion	How to verify
W2.7-AC01	Core	Before passkey creation, assign the new account its permanent WebAuthn user handle. If signup still uses a temporary account record, persist a reliable mapping from that handle and the returned credential ID to the final account.	Create a passkey before the final account record is completed, then finish signup and sign in with it. Add another passkey later. Both credentials resolve to the final account and use the same WebAuthn user handle.
W2.7-AC02	Core	When the chosen signup method is sufficient to authorize passkey creation, create the passkey before asking the user to verify a separate fallback such as a phone OTP. If it is not sufficient, complete the required verification first. A passkey created for a pending account becomes usable only after the required signup verification succeeds.	Test one signup policy that permits creation before fallback verification and one that requires verification first. In the first case, abandon the OTP and confirm that the pending account cannot sign in, then complete it and confirm that the passkey becomes usable. In the second case, passkey creation does not start before verification.
W2.7-AC03	Core	When the passkey is used as the account’s second factor, signup also completes a usable fallback for that factor. A collected phone number or email address counts only after its OTP or verification link succeeds.	Create the passkey and abandon fallback verification. The account is not considered ready for passkey-based MFA. Complete verification and confirm that the configured fallback can be used when the passkey is unavailable.

References

Relevant criteria: W2.7-AC01–AC02: How to get high passkey adoption in creation flows covers passkey creation during registration as a distinct enrollment opportunity.
Relevant criteria: W2.7-AC02–AC03: Passkey Intelligence, login identifiers and verification covers verification during signup, verification before first login and recovery identifiers.
Relevant criteria: W2.7-AC03: Passkeys user journeys covers establishing a recovery method when creating a new account with a passkey.
Relevant criteria: W2.7-AC01: Server-side passkey registration covers account-bound registration options and credential storage.

Overview

Web

Native

Passkey Creation: During Sign-Up

Acceptance criteria

References

​Passkey Creation During Sign-Up

​Acceptance criteria

​References

Passkey Creation During Sign-Up

Acceptance criteria

References