How do I enable passkeys in an iframe?

Enabling passkeys in iframes involves configuring specific permissions, headers, and user interaction conditions. Here's a step-by-step guide:

First, specify permissions using the iframe's allow attribute:

<iframe
    src="https://example.com"
    allow="publickey-credentials-get; publickey-credentials-create"
></iframe>

Include the corresponding HTTP response headers on your iframe source server to explicitly allow WebAuthn operations:

Permissions-Policy: publickey-credentials-get=(*), publickey-credentials-create=(*)

For enhanced security, limit to specific domains instead of *:

Permissions-Policy: publickey-credentials-get=("https://yourdomain.com"), publickey-credentials-create=("https://yourdomain.com")

Passkey operations (creation or authentication) must be triggered by a clear user action (also called "transient user activation"). Use event listeners for buttons or form submissions:

document.getElementById("loginPasskeyButton").addEventListener("click", async () => {
    try {
        const credential = await navigator.credentials.get({
            publicKey: publicKeyCredentialRequestOptions,
        });
        // Handle the authenticated credential
    } catch (err) {
        console.error("Passkey authentication error:", err);
    }
});

Verify correct Permissions-Policy settings in browser developer tools under the "Application → Frames" section.

Enterprise Passkey Whitepaper. Practical guidance, rollout patterns, and KPIs for passkey programs.

Get Whitepaper

Conduct cross-browser testing, especially in browsers with strict cross-origin rules (e.g., Safari).

Following these steps ensures secure and seamless passkey integration in iframes. .

About Corbado

Corbado is the Authentication Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: where passkeys, passwords, OTP, social login and fallback journeys succeed, stall or fail, which devices and browsers create friction, and when an OS update silently breaks login. Two products: Corbado Observe layers process mining and observability across authentication journeys. Corbado Connect adds managed passkeys with analytics built in alongside your IDP. VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →