Join our upcoming Webinar on Passkeys for Australian Enterprises

Can I create passkeys in cross-origin iframes?

Vincent Delitz

Vincent

Created: April 7, 2025

Updated: April 30, 2025

iframe passkeys webauthn cover

Read the full article

Discover how to create & login with passkeys in cross-origin iframes with our guide. Learn about iframes in WebAuthn, security policies, & implementation.

Read the full article

Read by 5,000+ security leaders.


Can I create passkeys in cross-origin iframes?#

Yes, creating passkeys within cross-origin iframes is currently possible, but it depends on browser support and specific technical requirements:

Current Browser Support (as of 2025)#

create passkeys cross origin iframes

Technical Requirements#

To successfully implement passkey creation in cross-origin iframes, you must:

  • Set proper HTTP Permissions-Policy headers:
    Permissions-Policy: publickey-credentials-get=(*), publickey-credentials-create=(*)
  • Include the correct allow attribute on your iframe element:
<CustomBanner type="Enterprise" /> - Ensure transient user activation (user gesture like clicks) to initiate the passkey creation. ## Future Browser Outlook It's not yet clear if Safari and other browsers will eventually support passkey creation in cross-origin contexts in the future. For production environments, always verify browser compatibility and provide fallback flows for unsupported scenarios, especially for Safari users ## Read the full article
iframe passkeys webauthn cover

Read the full article

Discover how to create & login with passkeys in cross-origin iframes with our guide. Learn about iframes in WebAuthn, security policies, & implementation.

Read the full article

Read by 5,000+ security leaders.

Schedule a call to get your free enterprise passkey assessment.

Talk to a Passkey Expert

Enjoyed this read?

🤝 Join our Passkeys Community

Share passkeys implementation tips and get support to free the world from passwords.

🚀 Subscribe to Substack

Get the latest news, strategies, and insights about passkeys sent straight to your inbox.

Share this article


LinkedInTwitterFacebook