Passkeys & MFA

Passkeys first. A number match when it counts.

Let people sign in with a passkey, add a second factor where policy asks for one, and approve sign-ins on Vaarta Authenticator by tapping the number shown on screen. Endless approve prompts stop working on your users.

Book a demo Get Vaarta Authenticator

In your browserCheck your phone47Tap this number in Vaarta Authenticator

Vaarta AuthenticatorSigning in to Objiq?Chrome on Mac · approximate location

184783

It wasn't me

Why it matters

Strong for attackers, easy for people

Phishing-resistant by default

Passkeys with user verification required, bound to a relying party per app.

Push that cannot be spammed

Only someone looking at the real sign-in knows which of three numbers to tap.

A safe way back

A single-use invitation to the verified address lets a person enrol a new factor, and nothing more.

How it works

A push approval with number matching

1PersonStarts signing inWith a login ID, a passkey or a password.
2Identity StudioPicks three numbersThree distinct two-digit numbers; the screen shows one.
3Vaarta AuthenticatorShows who is askingThe app, the browser and an approximate place, with all three numbers.
4PersonTaps the matchOr "It wasn't me", which refuses it on all their devices.
5Identity StudioVerifies the signed answerECDSA P-256 over a canonical message. The prompt expires after 10 minutes.

Standards we implement

Factors and standards

Factor	What we support	Status
WebAuthn passkeys (FIDO2)	As first factor in every app; as second factor on the consoles. User verification required by default; discoverable credentials preferred; sign count checked.	Live
RFC 6238 · TOTP	Authenticator-app codes: 6 digits, 30-second steps, a used code refused on replay.	Live
Recovery codes	Single-use, stored hashed; 10 by default (5 to 25).	Live
Push with number matching	Vaarta Authenticator, linked by QR code; signed answers; 3 resends per sign-in.	Live
One-time codes	By email, SMS or WhatsApp as a second factor: 6 digits, 5 minutes by default.	Live
Magic links	By email, 15 minutes by default.	Live
Step-up	A fresh factor before sensitive actions; one enrolled in the same session does not count.	Live
Yes / No approval style	A plain approve option where number matching is not required.	Early access
Native push delivery	APNs and FCM delivery to the phone.	Early access

Configuration

Per-application policy

Option	Values	Default
allow_password_login	Turn passwords off entirely	on
allow_passwordless_passkey	Passkey as the whole sign-in	on
require_second_factor	Require a second factor	off
second_factor_mode	any, or a specific list	any
allowed_second_factors	totp, push_approval, otp_email, otp_sms, otp_whatsapp, magic_link_email	totp
otp_code_length · otp_ttl_seconds	Length and lifetime of one-time codes	6 · 300
magic_link_ttl_seconds	Lifetime of a magic link	900
high_risk_recovery_route	human_assisted or self_service	human_assisted

Under the hood

What protects it

From the code

services/webauthn_service.pypasskey registration

selection_kwargs = {
    "user_verification": (uv_enum.REQUIRED
        if require_user_verification else uv_enum.PREFERRED),
}
if prefer_resident_key:
    selection_kwargs["resident_key"] = \
        m["ResidentKeyRequirement"].PREFERRED

options = generate_registration_options(
    rp_id=rp_id, rp_name=rp_name,
    user_id=user_id.encode("utf-8"),
    exclude_credentials=exclude_descriptors,
    authenticator_selection=m["AuthenticatorSelectionCriteria"](
        **selection_kwargs),
)

Security notes

Each application gets its own relying party ID, derived from its registered domains.
The person is emailed every time a phone is linked to their account.
A recovery invitation is single-use, mints no session and enrols an authenticator-app factor only.
The phone states how its key is stored; hardware attestation is not yet verified by the server.

Works with

Part of one platform

Hosted sign-in Make the push the whole sign-in.Conditional access & risk Ask for MFA when it matters.AI agents & MCP The same tap approves agent use.

Vaarta Vault ↗ Approve every reveal on your phone.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Turn on the tap that stops takeovers

Enable passkeys and link your first phone in a minute.

Book a demo Start free trial