Passwordless sign-in
An application wants users to authenticate without passwords using biometrics, device PINs, or security keys.
Better Auth · Function
passkey
Better Auth's passkey plugin enables passwordless WebAuthn authentication using device-stored credentials. Configure the plugin, update the database schema, and use client methods to register, sign in with, or manage passkeys.
How it works
The passkey plugin adds WebAuthn-based passwordless authentication. After configuring it and updating the database schema, an authenticated user can register passkeys, sign in with one, list their passkeys, or enable autofill for sign-in.
Syntax
passkey()Key points
- Passkeys provide passwordless authentication through cryptographic credentials.
- The browser-facing implementation follows WebAuthn and FIDO2 standards.
- Import the plugin from the separate @better-auth/passkey package.
- Use the client addPasskey operation to register a new credential.
- The plugin supports listing credentials belonging to the current user.
Common mistakes
- Database migration or schema generation is required after adding the plugin.
- Passkey registration requires an existing authenticated user.
- The plugin needs its dedicated passkey table.
Example: Configure and sign in with a passkey
import { betterAuth } from "better-auth";
import { passkey } from "@better-auth/passkey";
import { createAuthClient } from "better-auth/client";
export const auth = betterAuth({ plugins: [passkey()] });
const authClient = createAuthClient();
await authClient.signIn.passkey();Install the plugin, register it in the server configuration, then invoke the client method to begin passkey sign-in.
When to use it
Passkey registration
An authenticated user needs to add another device or security key.
Passkey management
A user needs to view the credentials associated with their account.
Passkey autofill
A frontend should offer passkey sign-in automatically when supported by the browser.
Interview questions
QWhat is a passkey?
Passkeys use WebAuthn-compatible cryptographic key pairs instead of passwords. The private key remains on the user's device, while the public key is associated with the website.
Follow-up: Why are passkeys resistant to phishing? The credential is bound to the relying party, so a fraudulent site cannot use the legitimate site's credential.
QHow do you enable passkeys in Better Auth?
Install @better-auth/passkey and add passkey() to the plugins array in betterAuth. Then migrate or generate the schema so the required passkey storage is available.
Follow-up: What must be done before registration? The user must already be authenticated.
QWhich client operations does the plugin expose?
Use authClient.signIn.passkey() to start passkey authentication. The same client API provides passkey.addPasskey for registration and listUserPasskeys for retrieving the authenticated user's passkeys.
Follow-up: How can passkey sign-in be prepared when a component loads? Call authClient.signIn.passkey with autoFill set to true.
Related
passkey.addPasskeysignIn.passkeypasskey.listUserPasskeysautoFillSimpleWebAuthnWebAuthnFIDO2