Passwordless passkey authentication
Pro Prisma and Pro Drizzle now include user-verified passkey registration, sign-in and account management through Better Auth and WebAuthn.
Both starter kits now support passwordless passkey authentication. Users can register and name multiple credentials from account security settings, sign in with a platform authenticator or security key, rename credentials and remove them with confirmation.
What changed
- Added Better Auth's passkey plugin to the Prisma and Drizzle authentication servers and clients.
- Added passkey tables, ORM relations and database migrations for both editions.
- Added Sign in with passkey below configured OAuth providers.
- Added a Passkeys card under Dashboard → Settings → Security with add, rename and delete workflows.
- Required biometric or device-PIN user verification during registration and checked the verified result server-side before session creation.
- Added explicit messages for cancelled, duplicate, failed and unverified WebAuthn ceremonies.
- Made
enablePasskeysdisable both the interface and server endpoints. - Preserved TOTP challenges for password sign-in without adding a redundant TOTP prompt after verified passkey authentication.
Verification
The release passed Oxlint, Oxfmt, TypeScript checks, focused authentication unit tests and Webpack production builds in both kits. Chromium Playwright tests cover registration, naming, rename, rejection without user verification, successful passwordless sign-in and deletion using a virtual WebAuthn authenticator.
Existing projects
Apply the included passkey migration before deploying the updated application.
No new environment variable is required. Passkeys require HTTPS in production;
browsers permit WebAuthn on localhost for development.
Read the passkey guide for Pro Prisma or Pro Drizzle.