Passkeys Are Easy to Demo and Hard to Ship. Here's the Part the Tutorials Skip

Short summary

WebAuthn/passkeys offer phishing-resistant authentication but tutorials stop at the demo—they skip production recovery flows. This post provides working code for registration and login using the SimpleWebAuthn library, then addresses the real shipping problem that causes most passkey rollouts to stall: what happens when users lose their passkey and need recovery via email fallback, dual enrollment, or recovery codes.

• •Passkeys are phishing-resistant because private keys never leave the user's device
• •Production failure point: recovery when users lose passkey access—no 'forgot passkey' email reset exists
• •Three recovery strategies with tradeoffs: email fallback (weaker security), dual enrollment (worse conversion), recovery codes

Generated with AI, which can make mistakes.