WebAuthn

WebAuthn (passkeys and security keys) provides phishing-resistant MFA.

Setup in the Web UI

1. Open Account Security
2. Click Enable MFA (or Add Method if MFA is already enabled; adding a method asks you to verify an existing one first)
3. Choose Passkey or security key
4. Follow your browser prompt to complete enrollment

Note

You can register multiple WebAuthn methods (recommended for redundancy).

Requirements

• User verification is required. Every registration and sign-in needs the key’s PIN or a biometric (Touch ID, Windows Hello). Set a PIN on a hardware key before registering it.
• Challenges are single-use and expire after 5 minutes. The gateway stores each challenge, ties it to your session, and deletes it when it’s used, so a captured response can’t be replayed.
• Signature counters are checked. If a key reports a counter that didn’t increase, the sign-in is refused because the key may have been cloned. Passkeys that always report 0 are fine.

Using WebAuthn

Web UI

When prompted for MFA, select the security key option and complete the browser prompt.

CLI

The CLI can use WebAuthn methods marked CLI Compatible:

1. In Account Security, edit your WebAuthn method
2. Enable CLI Compatible (recommended for hardware keys; passkeys stored in a browser or phone can’t be used from the CLI)
3. The CLI uses it when it’s your preferred method, or when you pass --mfa-method webauthn

The CLI needs security key support built in. The prebuilt Linux release doesn’t have it; see Installation.

rack-gateway deploy -a myapp --mfa-method webauthn

A CLI command asks for one key touch; the step-up window it starts covers the rest of the command. See MFA Verification.

Managing Methods

In Account Security → Registered MFA Methods, you can:

• Edit the label
• Toggle CLI Compatible (WebAuthn only)
• Remove a method (needs MFA every time)

Caution

Keep at least one MFA method active so you don’t lock yourself out.