Can Passkeys be used as an MFA method alongside email and authenticator app?

[FASupportBot]

I want to offer Passkeys as an additional MFA option in FusionAuth, alongside the existing email and authenticator app methods. However, I do not want Passkeys to be used as the primary login method — I still want to require email + password for the initial login.

Is it possible to configure Passkeys as an MFA method that appears in the hosted MFA picker alongside email and authenticator app, while keeping email + password as the only primary authentication method?

[FASupportBot]

Unfortunately, Passkeys cannot currently be used as an MFA method in FusionAuth's native hosted MFA flow. There is an open feature request for this functionality.

Workaround

You can implement a step-up authentication pattern using FusionAuth's WebAuthn API:

1. After the user completes email + password login, your application calls /api/webauthn/start
2. The authenticator produces a signature
3. Your application calls /api/webauthn/assert to verify possession of the passkey
4. Only grant access if the assertion succeeds

You can check whether a user has a registered passkey by calling /api/webauthn?userId={userId}.

Important limitation: This workaround runs in your application code, not inside FusionAuth's hosted MFA screen. Passkeys will not appear alongside email and authenticator app in the same native picker — you would need to build that UI and enforcement logic yourself in your application.

A feature request has been logged for native passkey MFA support in FusionAuth's hosted flow.

---

Related Documentation

• Authentication With WebAuthn & Passkeys - Complete guide to implementing WebAuthn/passkeys in FusionAuth
• WebAuthn API Reference - API endpoints for starting and completing WebAuthn authentication ceremonies
• Start a WebAuthn Passkey Assertion - Documentation for the /api/webauthn/start endpoint
• Retrieve a Passkey - How to check if a user has registered passkeys using /api/webauthn?userId={userId}
• Multi-Factor Authentication (MFA) - Overview of FusionAuth's native MFA methods (TOTP, email, SMS)
• Step-Up Authentication - General guidance on implementing step-up auth patterns in FusionAuth
• Can I do a step up authentication with WebAuthn/passkeys? - Community discussion on this exact use case