Passkeys are now supported by every major platform and can move between password managers. How to roll them out without locking anyone out: enrolment prompts, recovery, the relying-party ID you must choose correctly the first time, and what Cognito, Auth0 and the rest do for you.
Passkeys are phishing-resistant by design: the credential is bound to your domain, so a look-alike site cannot use it. They sync across a user's devices through their platform or password manager, and since Apple's 2026 operating systems they can be moved between participating credential managers using the FIDO Alliance's Credential Exchange formats: removing the old worry that a passkey locks someone into one ecosystem. Every major identity provider supports them; Cognito added passkeys to its Essentials and Plus tiers in November 2024.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
A passkey is created for a relying-party ID — a domain — and browsers only offer it on that domain and its subdomains. Choose app.example.com and the passkey will never appear on example.com or on a new auth.example.com; choose example.com and it works on all of them. Changing it later does not migrate anything: every passkey already enrolled silently stops being offered. Use the registrable parent domain unless you have a specific reason not to. On Cognito, with managed login and a custom domain, the RP ID defaults to the custom domain's full name — check it before the first user enrols.
Offer, do not force: prompt existing users to add a passkey right after a successful sign-in, when they have just proved who they are.
Keep a second factor of recovery — email or a backup method — until most users have passkeys on more than one device.
Show which passkeys an account has and let users name and remove them; a lost phone should be a settings change, not a support ticket.
Use conditional mediation (passkey autofill) on the sign-in form, so returning users are offered their passkey without hunting for a button.
Measure: enrolment rate, sign-in success rate with passkeys versus passwords, and recovery requests.
Managed login pages — Cognito's, Auth0's, Clerk's and others' — handle the WebAuthn ceremonies and the prompts. If you build your own sign-in, Cognito exposes the steps as API calls (StartWebAuthnRegistration, then completing with the browser's response), authorised with the user's access token. Either way, the RP ID decision and the recovery policy are yours.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Amazon Cognito in 2026: Everything That Changed, for Teams Who Wrote It Off
Cognito spent two years fixing the reasons people left it: new Lite, Essentials and Plus tiers with managed login and passkeys, then in 2026 multi-Region replication, password-hash import, client-secret rotation, federation triggers, self-service rate limits and machine-to-machine tokens without a domain. What changed, what it costs, and whether to look again.
Read
Passkeys for App Builders: What They Replace, What They Don't, and How to Roll Them Out
A passkey is a key pair: the private key stays on the user's device or in their password manager, and your server stores only the public key. Nothing to phish, nothing useful to steal from your database. How WebAuthn works, synced versus device-bound passkeys, account recovery, and a rollout that does not lock anyone out.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.