Home

Embedded Cross-Domain Passkey Authentication

User's Passkey authentication through an iframe. This involves embedding an iframe with a URL (unlock.offline.live) that is accessible across multiple domains, providing a seamless authentication experience.

Other terminology => "Unified Passkey Authentication" or "One-Click Passkey Login"

Passkey specs and issues

It is not possible to detect if user own a passkey for a specific domain in advance for privacy reason. Potential solutions are:

• Create a record for every user of context of creation of passkey (with user agent): http://devicedetector.net/ to know if user do have in this context access to a passkey

• Through webauthn Conditional UI (though only work on certain conditions and with an HTML input fields with autofill): https://www.corbado.com/blog/webauthn-conditional-ui-passkeys-autofill

• Why Passkey Implementation is 100x Harder Than You Think – Misconceptions, Pitfalls and Unknown Unknowns

• Smart Wallets and Passkeys

Passkey creation in cross-domain iframe not possible yet in IOS

• https://www.corbado.com/blog/iframe-passkeys-webauthn
• Issue from w3c https://github.com/w3c/webauthn/issues/1656
• Issue created on webkit https://github.com/WebKit/standards-positions/issues/304