Passkeys

Studio supports WebAuthn credentials for direct Passkey sign-in and as an MFA alternative after a password. TOTP enrollment remains required for every account. Register and manage credentials from the account security pages.

Registration and Verification

Registration requires account reauthentication. Studio requests a discoverable credential and authenticator user verification. Direct Passkey sign-in also requires user verification, commonly provided by the authenticator’s PIN or biometric check. Studio receives a signed assertion and verification result, not the PIN or biometric data.

The password-first MFA flow can use a registered WebAuthn credential as the second factor. That flow has already verified the password and does not impose the same user-verification requirement as passwordless sign-in.

An account can register up to 10 credentials. Each registration and authentication challenge expires after five minutes. Studio verifies the challenge, origin, relying-party ID, and credential before accepting the result.

Hostname Scope

The relying-party ID is the Studio hostname. A credential registered at studio.example.com is not a credential for a different Studio hostname. The credential list marks entries belonging to the current host or another host; renaming a credential does not change that scope.

After moving Studio to another hostname, use a working password and TOTP flow to register a credential there. A credential from the old hostname is not a recovery method at the new hostname.

Names and Authenticator Information

Two names have different meanings:

Name	Source
Credential name	A label you choose and can rename in Studio
Authenticator name	A name matched from the credential’s AAGUID against Studio’s bundled list

The AAGUID identifies an authenticator type or provider, not a unique physical device. A synced Passkey can be usable on multiple devices. Its displayed authenticator name is descriptive metadata, not an authorization decision or proof of a particular device model.

Studio uses a compact local snapshot from passkey-authenticator-aaguids. Displaying a name makes no external lookup. An absent, all-zero, or unknown AAGUID has no matched name; the chosen credential label remains available. The bundled list changes through Studio releases rather than live updates.

The details also show the relying-party ID, attestation format, available AAGUID, registration time, last use, and reported backup state. These describe the credential; they do not locate the device or expose its private key.

Removal and Recovery

Removing a credential prevents future use of that credential in this Studio installation. It does not remove a credential from your password manager or authenticator. Studio keeps the current session and revokes the account’s other sessions when removal succeeds. Use Sessions to review or explicitly end remaining browser access.

If TOTP is unavailable but a current-host Passkey still works, sign in and replace the TOTP factor. See MFA Recovery for this path and for administrator-assisted recovery when no factor works.