Passkeys (WebAuthn)
Add passwordless passkeys through better-auth’s passkey plugin and secure registration flows.
Registration
Offer passkey registration from account security settings after the user has a primary sign-in method. Relying party ID must match your production domain.
Sign-in
Passkey sign-in uses the Web Authentication API in the browser. Provide fallbacks for unsupported clients.
Security
Require user verification where appropriate and bind credentials to the current tenant when organizations are enabled.
Combine passkeys with 2FA for high-risk admin actions if your threat model requires step-up authentication.