mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-20 14:34:25 +00:00
318bfc36d7
# Which Problems Are Solved - Native iOS/Android passkeys need OS trust files on the ZITADEL domain; without them, Associated Domains / App Links verification fails. - Operators could not configure iOS Team ID + Bundle ID or Android package name + SHA-256 fingerprints on OIDC apps. - `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` were not served from application config. # How the Problems Are Solved - Add iOS/Android app-link fields on OIDC app create/update (Application API v2 + Management), with validation. - Persist and project those fields; query active app-link configs instance-wide. - Serve AASA (`webcredentials`) and Digital Asset Links (`get_login_creds`) from well-known paths, with configurable `Cache-Control` and fingerprint normalization at serve time. - Console UI to edit the fields, with links to the well-known endpoints. - Operator docs for configuration, endpoints, caching, and verification. # Additional Changes - Document on API fields that well-known responses may be HTTP-cached and platform verifiers may delay propagation. - Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`; `0` → `no-store`). # Additional Context - Closes #12497 - Implemented and reviewed as stack: - #12531 API contract - #12532 storage wiring - #12536 well-known endpoints - #12537 console - #12547 docs --------- Co-authored-by: Cursor <[email protected]>
41 lines
2.7 KiB
Plaintext
41 lines
2.7 KiB
Plaintext
---
|
|
title: "Passkeys & Passwordless Authentication in ZITADEL"
|
|
description: "Implement modern phishing-resistant passwordless authentication with FIDO2 passkeys."
|
|
sidebar_label: Passkeys
|
|
---
|
|
|
|
ZITADEL's passkeys feature enables passwordless authentication, offering a **smoother and more secure** login experience for your users. This document explains the essential details for developers.
|
|
|
|
### What are Passkeys?
|
|
|
|
Imagine signing in without passwords! Passkeys, replacing traditional passwords, leverage **public-key cryptography** similar to FIDO2 and WebAuthn. Users rely on their devices' **biometrics or PINs** for authentication, eliminating password burdens.
|
|
|
|
### Benefits for Developers
|
|
|
|
* **Enhanced Security:** Phishing-resistant passkeys minimize credential theft risks.
|
|
* **Streamlined User Experience:** Faster, easier logins free users from managing passwords.
|
|
* **Platform Agnostic:** Works across devices and platforms supporting passkeys.
|
|
* **Modern Standard:** Complies with the FIDO2 and WebAuthn standards.
|
|
|
|
### Features
|
|
|
|
* **Seamless Registration:** Create unique passkeys for users on various devices. Optionally pair them with specific users and choose cross-platform or platform-specific options.
|
|
* **User Control:** Users manage their passkeys directly through ZITADEL's self-service portal, allowing registration, viewing, and deletion.
|
|
* **Intuitive Login:** Users initiate passkey login by selecting the passkey option and verifying themselves with the device's biometrics (fingerprint, face ID, etc.).
|
|
* **Intuitive Login:** Users initiate passkey login by selecting the passkey option and verifying themselves with the device's biometrics (fingerprint, face ID, etc.).
|
|
* **Robust Fallback:** Traditional password login remains available for users without passkeys.
|
|
|
|
### Developer Resources
|
|
|
|
* **Documentation:** Passkeys Guide: [https://zitadel.com/docs/guides/integrate/login-ui/passkey](/guides/integrate/login-ui/passkey)
|
|
* [Create Passkey Registration Link API](/guides/manage/user/reg-create-user)
|
|
|
|
### Notes
|
|
|
|
* Passkey support is still evolving in browsers and platforms. Check compatibility for your target audience.
|
|
* ZITADEL actively develops its passkey features. Stay updated with documentation and releases.
|
|
* Passkeys are bound to your domain, thus we recommend configuring a [Custom Domain](/concepts/features/custom-domain) before setting up passkeys.
|
|
* Native iOS and Android apps that use platform passkey APIs also need domain association files. Configure them on the OIDC app and let ZITADEL serve the well-known documents — see [Native app links for passkeys](/guides/integrate/login/oidc/native-app-links).
|
|
|
|
Don't hesitate to ask if you have further questions about integrating passkeys in your ZITADEL application!
|