Key Lessons From Deploying Passkeys in Production With WebAuthn

Passkeys are WebAuthn public-key credentials that replace both passwords and second factors in a single authentication prompt, with the private key never leaving the user's device. One of the most critical implementation details is the Relying Party ID (RP ID), which must be set to the apex domain before any user registers, as it cannot be changed retroactively and determines where credentials are usable. The user.id field must be an opaque, non-identifying handle rather than an email address, since it gets permanently baked into the credential and cannot be rotated later. Conditional UI — which surfaces passkeys inside the browser's autofill dropdown — requires both the autocomplete='username webauthn' attribute on the input field and a separate navigator.credentials.get() call with mediation set to 'conditional'. Developers are also cautioned that passkeys shift rather than eliminate the account-recovery problem, making it important to retain password support during the transition period.