Passkey use only as 2FA option

Magnitaizer commented

2026-02-22 00:14:59 -06:00

(Migrated from github.com)

Hello!
I have been trying VoidAuth and I think it's the best auth system i've tried so far if you just need basic sso and user management, that's it.

I wanted to ask if that's possible to implement to remove passkey as authentication factor, only be used as 2FA.

Also having an ability to disable prompt on adding passkey upon authentication.

For example if user owns yubikey and it gets stolen or lost, then it's high security risk as it is automatically auths into voidauth and considering that is sso, then it automatically opens door for all
other apps bound to it

Thank you for your work, that app is amazing!

Hello! I have been trying VoidAuth and I think it's the best auth system i've tried so far if you just need basic sso and user management, that's it. I wanted to ask if that's possible to implement to remove passkey as authentication factor, only be used as 2FA. Also having an ability to disable prompt on adding passkey upon authentication. For example if user owns yubikey and it gets stolen or lost, then it's high security risk as it is automatically auths into voidauth and considering that is sso, then it automatically opens door for all other apps bound to it Thank you for your work, that app is amazing!

👍 3

notquitenothing commented

2026-02-25 21:31:20 -06:00

(Migrated from github.com)

Hello! VoidAuth requests MFA passkeys from providers, which means the passkey provider you use should require you to input a PIN or bio-metric when using the passkey. This means that passkeys by themselves should provide MFA and adequate security as long as the passkey provider complies with that request, please let me know if any of the passkeys you register with VoidAuth do NOT end up requiring an MFA factor to use, and I will look into why

To address the example of a lost YubiKey, I believe that the key itself would not be enough to authenticate since you would also need a PIN to use it. Let me know if this is not the case and I will re-evaluate.

Hello! VoidAuth requests MFA passkeys from providers, which means the passkey provider you use should require you to input a PIN or bio-metric when using the passkey. This means that passkeys by themselves should provide MFA and adequate security as long as the passkey provider complies with that request, please let me know if any of the passkeys you register with VoidAuth do NOT end up requiring an MFA factor to use, and I will look into why To address the example of a lost YubiKey, I believe that the key itself would not be enough to authenticate since you would also need a PIN to use it. Let me know if this is not the case and I will re-evaluate.

ldidry commented

2026-02-26 00:55:05 -06:00

(Migrated from github.com)

I’m currently giving VoidAuth a try (my favorite auth provider so far, thank you for that software!) and I’m able to use my yubikey as passkey without PIN.

My use of the yubikey makes that I don’t want to add a PIN on it because I would need to type my PIN a lot of times per day, adding to much friction to its use.

I’m currently giving VoidAuth a try (my favorite auth provider so far, thank you for that software!) and I’m able to use my yubikey as passkey without PIN. My use of the yubikey makes that I don’t want to add a PIN on it because I would need to type my PIN a lot of times per day, adding to much friction to its use.

notquitenothing commented

2026-02-26 18:39:09 -06:00

(Migrated from github.com)

Interesting! I have a PIN set on my yubikey and it is required to sign-in, though I guess if you don't have one set it can't ask for it. VoidAuth sets userVerification='preferred' when doing passkey auth, so technically it will be requested but not required for a passkey provider to ask for MFA. I may take a look at how passkey sign-in handles MFA, if user verification (MFA) is not provided by the passkey provider then the passkey should not satisfy MFA when signing in.

Interesting! I have a PIN set on my yubikey and it is required to sign-in, though I guess if you don't have one set it can't ask for it. VoidAuth sets `userVerification='preferred'` when doing passkey auth, so technically it will be requested but not required for a passkey provider to ask for MFA. I may take a look at how passkey sign-in handles MFA, if user verification (MFA) is not provided by the passkey provider then the passkey should not satisfy MFA when signing in.

Magnitaizer commented

2026-02-27 02:01:05 -06:00

(Migrated from github.com)

Unfortunately yubikeys don't have biometric authentication (at least most), so just phycical user interaction required there, just a touch. aswell as pin code(optional). I'm as t.enant administrator want to have also a password protection there, and use it only as mfa. I think it should be quite easy to implement, just hide as authentication option and hide prompt on using passkeys. (Using 2 extra environment variables)

I'm using that in a corporate environment and this option puzzles users. So they are not quite ready for passkeys yet :)

Totally agree with ididry, that's the most favourite SSO i've tried so far, so easy to use and sometimes you don't even notice how it works because it's so fast to use. I've used Keycloak and Authentik, then wanted to go with Zitadel or VoidAuth, but zitadel didn't have proxy option, but VoidAuth did. And It's the best sso i've tried so far.

Unfortunately yubikeys don't have biometric authentication (at least most), so just phycical user interaction required there, just a touch. aswell as pin code(optional). I'm as t.enant administrator want to have also a password protection there, and use it only as mfa. I think it should be quite easy to implement, just hide as authentication option and hide prompt on using passkeys. (Using 2 extra environment variables) I'm using that in a corporate environment and this option puzzles users. So they are not quite ready for passkeys yet :) Totally agree with ididry, that's the most favourite SSO i've tried so far, so easy to use and sometimes you don't even notice how it works because it's so fast to use. I've used Keycloak and Authentik, then wanted to go with Zitadel or VoidAuth, but zitadel didn't have proxy option, but VoidAuth did. And It's the best sso i've tried so far.

ZingyAwesome commented

2026-04-08 10:15:30 -05:00

(Migrated from github.com)

Like I mentioned in a previous issue, I would love to see this feature. A setting for userVerification='required' could also be useful.

Like I mentioned in a [previous issue](https://github.com/voidauth/voidauth/issues/106#issuecomment-3249611916), I would love to see this feature. A setting for `userVerification='required'` could also be useful.

notquitenothing commented

2026-04-08 17:36:42 -05:00

(Migrated from github.com)

I am going to fix what I view as the primary problem, passkeys supplied without user verification should not satisfy MFA. I think additional solutions will need to be made with this in mind, so that is what I am going to start with

Rows
Columns

Passkey use only as 2FA option #311