Passkeys

WebAuthn sign-in without passwords via the passkey plugin.

Enable with passkeys: {} (RP ID and origin derive from baseURL — pin PUBLIC_BASE_URL so the origin is stable behind a proxy):

const shelf = createShelfAuth({
  db: database,
  secret: process.env.SECRET!,
  baseURL: process.env.PUBLIC_BASE_URL!,
  passkeys: {},
});

Users enroll keys on /profile (register a 2nd key as backup) and sign in from the login page.

Requirements

• Secure context: localhost or HTTPS; browsers require isSecureContext + PublicKeyCredential. The UI hides passkey buttons on plain-HTTP hosts.
• Origin stability: RP ID defaults to the baseURL hostname; keep PUBLIC_BASE_URL stable when behind a reverse proxy.

See also session management and Auth concepts.

For other methods, see Overview and Configuration.