Skip to main content

Passkeys

Gatwy supports passkeys for phishing-resistant, passwordless sign-in.

Passkeys use the WebAuthn/FIDO2 standard and are bound to your domain origin. This means credentials created for one host cannot be replayed on a different host.

Why Passkeys​

  • No shared secret to steal from users
  • Strong phishing resistance through origin binding
  • Faster sign-in with built-in device authenticators
  • Better UX on managed devices and modern browsers

Supported Authenticators​

  • Platform authenticators (Windows Hello, Touch ID, Face ID)
  • Hardware security keys that support FIDO2/WebAuthn

Configuration​

  1. Open Settings -> Security -> Authentication.
  2. Enable Passkey login.
  3. Keep password login enabled during migration, or enforce passkey-first when your rollout is complete.

User Enrollment Flow​

  1. User signs in with an existing method (password, LDAP, or SSO).
  2. User opens profile security settings and chooses Add passkey.
  3. Browser prompts for biometric or security key verification.
  4. The new passkey is saved to the account and can be used on next login.

Login Flow​

  1. User opens the sign-in page and selects Sign in with passkey.
  2. Browser shows available authenticators for the current origin.
  3. User verifies with biometric/PIN/security key.
  4. Gatwy validates the assertion and creates the user session.

Rollout Recommendations​

  • Start with optional enrollment and monitor adoption.
  • Encourage users to register at least two passkeys (primary and backup).
  • Keep an account recovery path for lost devices.
  • Use TLS in production so WebAuthn works reliably and securely.

Browser Notes​

Passkeys require a modern browser with WebAuthn support. If a browser does not support passkeys, users can fall back to enabled methods such as local password, LDAP, or OIDC.