---
description: How Studio uses Passkeys, binds credentials to a hostname, and displays authenticator information from AAGUIDs.
---

# Passkeys

Studio supports WebAuthn credentials for direct Passkey sign-in and as an MFA
alternative after a password. TOTP enrollment remains required for every
account. Register and manage credentials from the account security pages.

## Registration and Verification

Registration requires account reauthentication. Studio requests a discoverable
credential and authenticator user verification. Direct Passkey sign-in also
requires user verification, commonly provided by the authenticator's PIN or
biometric check. Studio receives a signed assertion and verification result,
not the PIN or biometric data.

The password-first MFA flow can use a registered WebAuthn credential as the
second factor. That flow has already verified the password and does not impose
the same user-verification requirement as passwordless sign-in.

An account can register up to **10 credentials**. Each registration and
authentication challenge expires after five minutes. Studio verifies the
challenge, origin, relying-party ID, and credential before accepting the result.

## Hostname Scope

The relying-party ID is the Studio hostname. A credential registered at
`studio.example.com` is not a credential for a different Studio hostname.
The credential list marks entries belonging to the current host or another
host; renaming a credential does not change that scope.

After moving Studio to another hostname, use a working password and TOTP flow
to register a credential there. A credential from the old hostname is not a
recovery method at the new hostname.

## Names and Authenticator Information

Two names have different meanings:

| Name | Source |
| --- | --- |
| Credential name | A label you choose and can rename in Studio |
| Authenticator name | A name matched from the credential's AAGUID against Studio's bundled list |

The AAGUID identifies an authenticator type or provider, not a unique physical
device. A synced Passkey can be usable on multiple devices. Its displayed
authenticator name is descriptive metadata, not an authorization decision or
proof of a particular device model.

Studio uses a compact local snapshot from
[passkey-authenticator-aaguids](https://github.com/passkeydeveloper/passkey-authenticator-aaguids).
Displaying a name makes no external lookup. An absent, all-zero, or unknown
AAGUID has no matched name; the chosen credential label remains available.
The bundled list changes through Studio releases rather than live updates.

The details also show the relying-party ID, attestation format, available
AAGUID, registration time, last use, and reported backup state. These describe
the credential; they do not locate the device or expose its private key.

## Removal and Recovery

Removing a credential prevents future use of that credential in this Studio
installation. It does not remove a credential from your password manager or
authenticator. Studio keeps the current session and revokes the account's other
sessions when removal succeeds. Use [Sessions](../sessions/index.md) to review
or explicitly end remaining browser access.

If TOTP is unavailable but a current-host Passkey still works, sign in and
replace the TOTP factor. See [MFA Recovery](../mfa-recovery/index.md) for this
path and for administrator-assisted recovery when no factor works.