Amazon Passkeys: Response to Consumer Demand with Poor Implementation

Amazon, the e-commerce behemoth, has recently and silently joined the passkey bandwagon. Recognizing the increasing demand by consumers to enhance security and in particular user convenience, Amazon rolls out passkeys widely across most devices and browsers. This underlines Amazons commitment to bend to consumer demand. This move follows the trend among tech giants, with Apple, Google, and others like TikTok, OnlyFans and Uber leading the passkeys wave, while Amazon rather late joins the party.

Screenshot 1: Amazon Passkey Sign in

Read also our in-depth analysis on e-commerce funnels at Amazon.

The Upside of Amazons Passkey Integration#

• Enhanced Security: Passkeys make users lives safer, mitigating phishing threats and eliminating the hassle of coming up and remembering passwords.
• Consumer Education: Given Amazon's vast user base, this rollout is set to familiarize a large segment of non-tech-savvy users with the benefits of passkeys. The ease of use might convince these users to demand passkeys from other online platforms as well.
• Industry Implications: The ripple effect of Amazon's move can potentially catalyze a widespread shift in the e-commerce and SaaS industry towards quick passkey adoption.

Screenshot 2: Amazon Passkey Overview & FAQ

Why Amazon messed up its Passkey Implementation#

• Relying Party ID Issues: Depending on a user's country that he has set, he may be redirected to different Amazon domains, requiring separate passkeys for each country / top-level domain. This is due to the security structure of passkeys, as each passkey needs to be registered for one Relying Party ID (e.g. amazon.com and amazon.de). In screenshot 3, you see that for one device (Windows 11 with Chrome) two passkeys were set up.
• Conditional UI Is Missing: By not implementing Conditional UI (Passkey Autofill), Amazon missed out on a critical feature that could have made passkey use even more seamless for users. The reasons behind are still unclear as other companies have implement Conditional UI already.
• Inferior Device Management: Current device detection and management for passkeys is clunky, possibly leading to user confusion, especially for those using browsers like Chrome on Mac, where a QR code was shown instead of explaining that a passkey is not available or just skipping passkeys (QR codes still being a major struggle for most consumers).
• No Native App Support: Surprisingly, native apps either for Amazon's shopping app or for Prime Video lack passkey support (see screenshot 4 and 5 below with the message that no passkey could be created) which could lead to user confusion if a passkey was created on this device via the web application.
• Redundant Verification Steps: If a user has set up 2-step verification, they still need to go through an additional one-time code verification, which is kind of an unnecessary steps as passkeys are 2FA by default.

Screenshot 3: Two Passkeys for Two Relying Party IDs on the Same Device (Windows 11 + Chrome 118)

Screenshot 4: Amazon Passkeys on Native Android App

Screenshot 5: Amazon Passkeys on Native iOS App

Looking Forward#

Amazon has room for improvement. Prioritizing updates like making native apps passkey-ready, introducing Conditional UI, and refining device management can considerably enhance user experience. Addressing the Relying Party ID issue would also be a step in the right direction but here best practices in the industry for multi-national services still need to be defined.

In conclusion, while Amazon's venture into passkey authentication is a significant milestone, it's evident that the journey to perfecting this feature is just beginning. Lets hope that Amazon takes the feedback on board and iterate a better passkey implementation soon.

How Corbado can help#

Every finding above came from testing Amazon's login by hand, on a handful of devices, which is the only way in when the implementation belongs to someone else. Running your own login that way scales badly, because none of these four problems shows up on a dashboard by itself. Corbado Observe, the authentication observability layer, turns them into numbers on your own login.

• Autofill coverage. Conditional UI keeps getting postponed because nobody knows what it would be worth. Observe records conditionalGet per client environment, so the share of your traffic that could get passkey autofill today is a figure instead of an opinion.
• The QR prompt on the wrong device. The Chrome on Mac complaint above is a client that was offered a cross-device flow it should never have seen. isUserVerifyingPlatformAuthenticatorAvailable and hybridTransport are recorded per client environment, which is what separates "no passkey here" from "no passkey support here".
• The redundant one-time code. A login is classified into subflows, so a passkey login followed by an SMS or email one-time code inside the same process is visible as the pattern this post criticises, and the funnel shows what that extra step costs in completed logins.
• One brand, several domains. Every ceremony carries the origin it ran on, and the Markets view breaks the login down by region, so a passkey created on one regional domain and never reused on another stops being invisible.

See Login Funnel in Corbado Observe →

None of this needs a passkey programme to be running first, which is the situation most retailers reading an Amazon post-mortem are actually in. Corbado Connect is the step after that, when you decide which devices get offered a passkey at all.

About Corbado

Corbado is the Passkey Intelligence Platform for large-scale CIAM teams running consumer authentication. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →

Frequently Asked Questions#

Why does Amazon make me use a different passkey for each country's website?#

Amazon redirects users to regional domains (such as amazon.com or amazon.de) based on their country setting, and each passkey is cryptographically bound to a specific Relying Party ID. Because amazon.com and amazon.de are distinct Relying Party IDs, a separate passkey must be registered for each, meaning a single device can end up storing multiple Amazon passkeys.

What is Conditional UI and why should Amazon add it to its passkey flow?#

Conditional UI, also called Passkey Autofill, surfaces available passkeys directly in the username field so users can authenticate without navigating extra menus. Amazon has not implemented this feature despite other companies already doing so, making its passkey experience less intuitive than the current industry standard.

Can I sign into the Amazon shopping app or Prime Video with a passkey?#

No. As of this analysis, neither Amazon's native shopping app nor Prime Video supports passkey authentication. Users who create a passkey through Amazon's web application may encounter an error or unexpected behaviour when trying to sign in through the mobile apps.

Why am I still asked for a one-time code after signing into Amazon with a passkey?#

Amazon still triggers an OTP prompt for accounts that have 2-step verification enabled, even after a successful passkey authentication. This step is redundant because passkeys inherently satisfy two-factor authentication requirements by combining device possession with biometric or PIN verification.