Skip to content
Muljax ID

WebAuthn & Passkeys

Muljax ID provides passwordless authentication using the FIDO2 / WebAuthn standard. You can sign in using platform authenticators (such as Touch ID, Apple Face ID, or Windows Hello) or roaming hardware security keys (such as YubiKeys).

What are Passkeys?

Section titled “What are Passkeys?”

Passkeys replace traditional passwords with cryptographic public/private keypairs:

  • Private Key: Generated and securely stored inside your device’s Secure Enclave or hardware security key. It never leaves your device.
  • Public Key: Sent to and stored by the server in the passkeys table.
  • Phishing Resistance: Authenticators cryptographically bind signatures to the exact website origin (e.g. https://id.example.com).

Because WebAuthn relies on browser APIs (navigator.credentials.create and navigator.credentials.get), passkey registration and authentication take place entirely within the web browser.

Registering a Passkey in the Dashboard

Section titled “Registering a Passkey in the Dashboard”

  1. Log in to your account on the dashboard.

  2. Navigate to Account -> Passkeys (/account/passkeys).

  3. Click Add Passkey.

  4. Enter a descriptive label for your device (e.g., "MacBook Pro Touch ID" or "YubiKey 5C NFC").

  5. Follow your browser and operating system prompt:

    • For biometric login, scan your fingerprint or face when prompted.
    • For a hardware key, insert the key into USB and tap the capacitive contact.

  6. The dashboard completes the WebAuthn attestation verification, and your new credential is added.

Authenticating with a Passkey

Section titled “Authenticating with a Passkey”

  1. On the login screen (/login), click Sign in with a passkey.

  2. When prompted by the browser, verify your biometric or tap your security key.

  3. Upon cryptographic challenge verification, an authenticated session cookie is set and you are redirected to the dashboard.

Managing Passkeys

Section titled “Managing Passkeys”

Under Account -> Passkeys, you can review all registered authenticators:

  • Device Label: Descriptive name of the passkey.
  • Added Date: When the authenticator was enrolled.
  • Last Used Date: The timestamp of the most recent authentication.
  • Revocation: Click Remove to delete a lost device or retired security key. Deleting a passkey immediately removes its credential ID from the database, preventing future logins with that device.