When Can Passkeys Be Verified?

When Can Passkeys Be Verified?#

Passkeys can be verified during the authentication process, once the user has created or registered their passkey with a service (relying party). Verification occurs when the user presents their passkey to confirm their identity, typically during login. The key factors that determine when passkeys can be verified include the initial registration, user authentication attempts, and the security policies of the application or service.

Passkeys are verified during user authentication after registration.
The timing of verification is determined by the user’s interaction with the service and the service’s security requirements.
Verification ensures that the user attempting to log in is the rightful owner of the registered passkey.

Understanding Passkey Verification Timing#

Passkeys are an innovative solution for passwordless authentication, and understanding when they can be verified is crucial for implementing secure user flows. Here’s a deeper dive into the process:

Passkey Registration: The first step in the lifecycle of a passkey is registration. During this process, the user creates a passkey, which typically involves a biometric scan (like a fingerprint or facial recognition) or another secure method tied to a specific device. This passkey is then stored securely either on the user’s device or in a cloud-based service.
User Authentication: Once a passkey has been registered, it can be verified during subsequent login attempts. When a user tries to log in, they must present the passkey through the same biometric method or device. The service then verifies that the presented passkey matches the registered one, allowing access if it does.
Security Policies: The timing of passkey verification can also depend on the security policies of the application or service. For example:
- Continuous Verification: Some services may require continuous verification, where the user’s passkey is verified multiple times during a session to ensure ongoing security.
- Event-Triggered Verification: Other services might only verify the passkey during specific events, such as login, reauthentication, or when accessing sensitive information.
Trustworthiness of Devices: Passkey verification is also dependent on the trustworthiness of the user’s device. If a user tries to authenticate from an untrusted or new device, additional verification steps, like two-factor authentication (2FA), might be triggered before the passkey can be verified.

Technical Considerations#

For developers implementing passkeys, understanding the verification process is essential:

WebAuthn API: Developers use the WebAuthn API to manage passkey creation and verification. The API handles communication between the user's device and the service, ensuring secure exchanges of credentials.
Fallback Options: Implementing fallback options, such as backup passkeys or recovery codes, can ensure that users can still access their accounts even if their primary device is unavailable.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →