How to prevent creation of multiple passkeys for 1 account?

In WebAuthn-based authentication, it is possible for users to create multiple passkeys for the same account across different devices or passkey providers. While this improves redundancy and accessibility, some organizations may want to restrict multiple passkey registrations to prevent confusion or enforce security policies.

WebAuthn provides a built-in feature called excludeCredentials, which prevents users from registering multiple passkeys for the same account.

During passkey registration, the server checks if the user already has an existing passkey and blocks additional registrations.

Example:

{
    "challenge": "random-challenge-string",
    "rp": { "name": "Example Corp", "id": "example.com" },
    "user": { "id": "user-id", "name": "user@example.com", "displayName": "User Name" },
    "excludeCredentials": [
        {
            "id": "existing-passkey-id",
            "type": "public-key"
        }
    ],
    "authenticatorSelection": { "residentKey": "preferred" },
    "attestation": "none",
    "pubKeyCredParams": [{ "type": "public-key", "alg": -7 }]
}

• Implement server-side validation to limit each user to a single registered passkey.
• Before allowing a new passkey registration, check the user’s existing credentials in your database.

• Inform users when they attempt to register a new passkey if one already exists.
• Offer users an option to delete or replace their previous passkey.

Subscribe to our Passkeys Substack for the latest news.

Subscribe

Enterprise environments can enforce passkey policies through an admin panel where IT teams can limit passkey creation.

Instead of blocking multiple passkeys, educate users on how to manage them properly, ensuring they have a backup passkey in case of device loss.

By using WebAuthn’s `excludeCredentials* parameter, implementing server-side checks and providing user-friendly feedback, organizations can prevent the unnecessary creation of multiple passkeys for a single account while maintaining secure and seamless authentication.