Passkeys

Passkeys replace passwords with a key pair stored on the user's device or in their password manager. Sign-in is a fingerprint, face scan, or device PIN, and there is nothing to phish or leak: Ploy stores only the public key.

Enable passkeys

Open Auth → Settings in the dashboard, turn on Passkeys, and save. No provider setup is needed.

Passkeys can be the only sign-in method or sit alongside passwords and social sign-in.

What users can do

Passkey sign-up refuses an email that already has an account; the user signs in first and then adds a passkey. This stops anyone from attaching their passkey to someone else's account.

With React

SignInForm shows a passkey button and SignUpForm offers passkey sign-up when passkeys are on. For a custom UI or an account settings page, use useAuth:

"use client";

import { useAuth } from "@meetploy/auth-react";

export function PasskeySettings() {
	const { signInWithPasskey, addPasskey, listPasskeys, removePasskey } =
		useAuth();

	return (
		<>
			<button onClick={() => signInWithPasskey()}>
				Sign in with a passkey
			</button>
			<button onClick={() => addPasskey("My laptop")}>Add a passkey</button>
		</>
	);
}

Domains

A passkey belongs to the domain it was created on. A passkey made on app.example.com works only there, not on your default deployment URL or a preview URL. Point users at one canonical domain for sign-in.

Local development

Browsers allow passkeys on localhost without HTTPS, so ploy dev supports passkeys out of the box. Passkeys created locally only work locally.