--- url: 'https://www.corbado.com/blog/ios-26-passkeys' title: 'iOS 26 Passkeys: Passkey Enhancements Analysis (WWDC25)' description: 'Explore the key passkey enhancements in iOS 26. This guide covers the new Passkey Account Creation API, secure import/export and lifecycle management.' lang: 'en' author: 'Vincent Delitz' date: '2025-06-18T15:15:32.752Z' lastModified: '2026-08-28T12:02:13.327Z' keywords: 'iOS 26 passkeys, ios 26' category: 'WebAuthn Know-How' --- # iOS 26 Passkeys: Passkey Enhancements Analysis (WWDC25) ## Key Facts - iOS 26 delivers four passkey enhancements: **secure import/export**, a one-tap Account Creation API, management endpoints and **WebAuthn Signal API** support for full lifecycle management. - The **FIDO CXP-aligned** transfer is user-initiated, requires biometrics and occurs app-to-app on the same device, avoiding insecure intermediate files. - **`ASAuthorizationAccountCreationProvider`** enables passwordless-by-default onboarding, combining account creation and passkey provisioning in a single native system UI step. - For **iCloud Keychain** consumer passkeys, Apple sends a zeroed-out AAGUID, prioritizing user privacy over hardware verification while keeping enterprise attestation available for managed device scenarios. ## 1. Introduction: iOS 26 Passkeys The release of [iOS](https://www.corbado.com/blog/webauthn-errors) 26 moves Apple's [passkey strategy](https://www.corbado.com/blog/passkeys-product-design-strategy) from foundational to mature, delivering enhancements to address developer friction and user lock-in. The key improvements focus on credential portability, frictionless onboarding and complete lifecycle management. **Table 1: Summary of Key Passkey Enhancements in iOS 26** | Feature/Enhancement | Core Purpose | Key Apple API / Standard | | :--------------------------- | :------------------------------------------------------------------------- | :----------------------------------------------------------------- | | Secure Passkey Import/Export | Eliminate vendor lock-in with user-controlled credential migration. | `ASCredentialExportManager`, `ASCredentialImportManager`, FIDO CXP | | Passkey Account Creation API | Enable one-tap, passkey-first account registration. | `ASAuthorizationAccountCreationProvider` | | Passkey Management Endpoints | Improve discoverability of a service's passkey management pages. | `/.well-known/passkey-endpoints` | | WebAuthn Signal API Support | Keep passkey metadata synchronized between service and credential manager. | `ASCredentialUpdater`, WebAuthn Signal API | These enhancements arrive on top of an already-strong iOS passkey baseline. The [Corbado Passkey Benchmark 2026 Conditional Create rate analysis](https://www.corbado.com/passkey-benchmark-2026/conditional-create) classifies iOS web ecosystem readiness as _Very strong_ with a +42–62% add-on contribution to [passkey enrollment](https://www.corbado.com/blog/passkey-creation-best-practices) in Q1 2026 — the highest of any platform, driven by Apple's tight integration of Safari, the [platform authenticator](https://www.corbado.com/glossary/platform-authenticator) and [iCloud Keychain](https://www.corbado.com/glossary/icloud-keychain). The [Corbado Passkey Benchmark 2026 web passkey readiness analysis](https://www.corbado.com/passkey-benchmark-2026/web-passkey-readiness) reports iOS web readiness at 99% at end of 2025, though the iOS 26.2 [WKWebView](https://www.corbado.com/blog/native-app-passkeys) `isUVPAA()` regression starts drawing third-party-browser readiness down in Q1 2026 before recovery — exactly the kind of edge case that iOS 26's Signal API and automatic-upgrade primitives help applications navigate. ## 2. Secure Passkey Import and Export [iOS](https://www.corbado.com/blog/webauthn-errors) 26 introduces secure credential portability, allowing users to move passkeys between [iCloud Keychain](https://www.corbado.com/glossary/icloud-keychain) and third-party managers like [1Password](https://www.corbado.com/blog/1password-passkeys-best-practices-analysis). Using [FIDO Alliance](https://www.corbado.com/glossary/fido-alliance)-aligned schemas and data formats (drawing on the FIDO Credential Exchange work), the transfer is user-initiated, requires biometrics and occurs directly app-to-app as a same-device flow, avoiding insecure intermediate files. For developers of credential managers, Apple introduced `ASCredentialExportManager` and `ASCredentialImportManager`. This portability comes with trade-offs in [attestation](https://www.corbado.com/glossary/attestation): Apple's consumer synced passkeys generally omit platform [attestation](https://www.corbado.com/glossary/attestation) statements to protect [user privacy](https://www.corbado.com/faq/ensure-gdpr-compliance-with-passkeys), though enterprise [attestation](https://www.corbado.com/glossary/attestation) features remain available for [managed device](https://www.corbado.com/blog/passkeys-managed-ios-android-testing) scenarios. For passkeys synced via [iCloud Keychain](https://www.corbado.com/glossary/icloud-keychain), Apple's implementation sends a zeroed-out [AAGUID](https://www.corbado.com/glossary/aaguid), a strategic choice that prioritizes ecosystem openness and [user privacy](https://www.corbado.com/faq/ensure-gdpr-compliance-with-passkeys) over hardware verification for most consumer use cases. ![ios 26 passkey creation](https://s3.eu-central-1.amazonaws.com/corbado-cloud-staging-website-assets/ios_26_passkey_creation_2f3c8441a4.PNG)_Passkey Creation in iOS 26_ ## 3. Passkey Account Creation API The new [Passkey Account Creation API](https://www.corbado.com/blog/passkey-account-creation-api) enables a passwordless-by-default onboarding experience. Developers can invoke a native system UI that handles account creation and passkey provisioning in a single, frictionless step. For more details about the implementation and impact, please refer to our dedicated blog post about the [Passkey Account Creation API](https://www.corbado.com/blog/passkey-account-creation-api). ![ios 26 passkey overlay](https://s3.eu-central-1.amazonaws.com/corbado-cloud-staging-website-assets/ios_26_passkey_overlay_609ee1d171.PNG)_Passkey Overlay in iOS 26 Apps_ ![ios 26 passkey login](https://s3.eu-central-1.amazonaws.com/corbado-cloud-staging-website-assets/ios_26_passkey_login_7bc65819fe.PNG)_Passkey Login in iOS 26_ ## 4. Enhancements for the Full Passkey Lifecycle [iOS](https://www.corbado.com/blog/webauthn-errors) 26 introduces critical enhancements for managing passkeys throughout their lifecycle. - **Passkey Management Endpoints:** By hosting a simple JSON file at `/.well-known/passkey-endpoints`, services can declare their [passkey enrollment](https://www.corbado.com/blog/passkey-creation-best-practices) and management URLs, allowing credential managers to link users directly to the correct pages. - **WebAuthn Signal API:** Support for the W3C's [WebAuthn Signal API](https://www.corbado.com/blog/webauthn-signal-api) allows a service to proactively "signal" changes to the user's device (e.g., username changes), ensuring the passkey stored locally remains accurate. This is available to native apps via the `ASCredentialUpdater` class and to websites via a corresponding JavaScript API in the browser. ![ios 26 passkey settings](https://s3.eu-central-1.amazonaws.com/corbado-cloud-staging-website-assets/ios_26_passkey_settings_ad1544dc9f.PNG)_iOS 26 Passkey Settings_ ## 5. How Corbado can help Section 4 puts the interesting burden on the [relying party](https://www.corbado.com/glossary/relying-party). Both of the lifecycle features run outbound: you publish `/.well-known/passkey-endpoints` so a credential manager can send users to the right page, and you emit Signal API calls so its stored copy stops drifting from yours. Neither happens unless your login code does it on every relevant event, and that is the part [Corbado Connect](https://www.corbado.com/connect) already carries. [Video: Manage passkeys](https://www.corbado.com/videos/connect/manage-passkeys.mp4) ([See how Corbado Connect ships this](https://www.corbado.com/connect)) A delete is the event that matters most, because a credential the user removed is exactly what a manager keeps suggesting afterwards. Connect fires `signalAllAcceptedCredentials` after the deletion completes, feature-detected so nothing breaks on a browser that lacks it and raced against a timeout so a slow call never holds up the response. Whether the browser answered at all is then a question of coverage: [Corbado Observe](https://www.corbado.com/observe) charts `signal` as one of the six keys on its [Client Capabilities](https://www.corbado.com/blog/webauthn-client-capabilities) page, so you can size the support for it across your own traffic before deciding how much of your lifecycle handling to hang on it. Portability adds a second-order problem that section 2 hints at. Once a passkey can move between managers, the metadata your account page shows about it ages. The created-with browser and OS that `CorbadoConnectPasskeyList` displays tells the user where a credential was born. It says nothing about where the credential lives today, which is a caveat worth writing into the UI copy rather than a bug to chase. ## 6. Conclusion The passkey enhancements in iOS 26 represent a comprehensive approach to advancing digital security and user convenience. These enhancements focus on four key areas: secure credential portability, seamless account creation, effective passkey lifecycle management, and synchronization of passkey metadata. Together, these improvements aim to reduce friction, enhance [user privacy](https://www.corbado.com/faq/ensure-gdpr-compliance-with-passkeys), and promote widespread adoption of passkeys as a secure alternative to traditional authentication methods. By addressing both user and developer needs, iOS 26 sets a new standard for [digital identity](https://www.corbado.com/blog/digital-identity-guide) management. ## Frequently Asked Questions ### How do iOS 26's ASCredentialExportManager and ASCredentialImportManager work for third-party credential managers? iOS 26 introduces `ASCredentialExportManager` and `ASCredentialImportManager` as the developer APIs for credential portability. The transfer uses FIDO CXP-aligned schemas and flows directly app-to-app on the same device. Third-party managers such as 1Password can participate as both import and export destinations in this user-initiated flow. ### How does the iOS 26 Passkey Account Creation API eliminate the need for traditional registration forms? The `ASAuthorizationAccountCreationProvider` API presents a native system UI that handles account creation and passkey provisioning simultaneously in a single step. This removes the need for developers to build custom onboarding screens and makes a passwordless-by-default registration experience achievable with one API call. ### How do I keep passkey metadata synchronized when a user changes their username or account details on iOS 26? The WebAuthn Signal API, accessed via the `ASCredentialUpdater` class in native iOS apps and a corresponding JavaScript API in browsers, lets a service proactively push metadata changes such as username updates to the user's device. This keeps locally stored passkey records accurate without requiring users to re-enroll. ### Why does Apple omit platform attestation for consumer iCloud Keychain passkeys in iOS 26? Apple deliberately omits platform attestation statements for consumer synced passkeys, sending a zeroed-out AAGUID instead. This trade-off prioritizes ecosystem openness and user privacy over hardware-level verification for most consumer scenarios. Enterprise attestation features remain fully available for managed device deployments where hardware verification is required.