PHPackages magedevgroup/module-customer-passkey - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. magedevgroup/module-customer-passkey ActiveMagento2-module[Authentication & Authorization](/categories/authentication) magedevgroup/module-customer-passkey ==================================== Passwordless, phishing-resistant customer login for the Magento 2 storefront using passkeys (WebAuthn / FIDO2). Magento is the relying party — no external IdP. Standalone; coexists with customer-sso. 0.0.2(1mo ago)021OSL-3.0PHPPHP ~8.3.0||~8.4.0||~8.5.0 Since Jul 9Pushed 1mo agoCompare [ Source](https://github.com/MageDevGroup-com/module-customer-passkey)[ Packagist](https://packagist.org/packages/magedevgroup/module-customer-passkey)[ RSS](/packages/magedevgroup-module-customer-passkey/feed)WikiDiscussions master Synced 1w ago READMEChangelogDependencies (6)Versions (3)Used By (0) MageDevGroup\_CustomerPasskey ============================= [](#magedevgroup_customerpasskey) > Passwordless storefront login for Magento 2 with passkeys (WebAuthn / FIDO2). [![License](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e)](https://camo.githubusercontent.com/83286826e7422502369a480c1cbde06eae433c866ac3e9054835db7296a11c9c/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4f534c2d2d332e302d677265656e) [![Magento](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765)](https://camo.githubusercontent.com/74f990c6f6a950cfc7707cb6d3cfdc731382be6260dfab995f14da50230e9117/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4d6167656e746f2d322e342d6f72616e6765) [![PHP](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565)](https://camo.githubusercontent.com/49c1441e4607accdb38fb505c51c881b13dabea9a2726b234d7ad218befce9fb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332d2d382e352d626c7565) [![Version](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579)](https://camo.githubusercontent.com/6a24c9197bfc07f07d3f136dc182a76b14d3cd2f8d473fbc3729540c9a4c5410/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f76657273696f6e2d302e302e312d6c6967687467726579) Passwordless, phishing-resistant customer login for the Magento 2 storefront using **passkeys (WebAuthn / FIDO2)**. Magento is the relying party (verifier) — there is no external IdP, no OIDC, and no shared SSO core. The module is standalone and coexists with `customer-sso` on the same login page and the same `customer_entity`. Requirements ------------ [](#requirements) - Magento 2.4.9 (`magento/framework >= 103.0`), PHP 8.3–8.5 - `web-auth/webauthn-lib ^4.0` - HTTPS on the storefront (WebAuthn requires a secure context) Install ------- [](#install) ``` composer require magedevgroup/module-customer-passkey bin/magento module:enable MageDevGroup_CustomerPasskey bin/magento setup:upgrade bin/magento setup:di:compile # production mode ``` This creates the `magedevgroup_passkey_credential` table (one row per registered passkey, cascades with its customer). Configuration ------------- [](#configuration) Admin → Stores → Configuration → **MageDevGroup → Customer Passkey → General**(`magedevgroup_customer_passkey/general/*`). Configurable per website/store view. FieldDefaultNotesEnable Passkey LoginNoMaster switch; adds the button and enables all endpoints.Relying Party Display Namestore nameName the authenticator shows during a ceremony.User Verificationpreferred`required` / `preferred` / `discouraged` — force PIN/biometric or not.Authenticator Attachmentany`any` / `platform` (Touch ID, Windows Hello) / `cross-platform` (security keys).Ceremony Timeout (ms)60000Browser wait for the authenticator.Allow Passwordless Sign-InYesOffers usernameless "Sign in with a passkey" via discoverable credentials. The storefront login button also requires this to be Yes.The **RP ID** is derived from the base-URL host (e.g. `magento.loc`); the origin is validated against the store URL. Both must be stable HTTPS hosts. Usage ----- [](#usage) **Add a passkey** — a logged-in customer opens My Account → **Passkeys**, clicks *Add a passkey*, and completes the browser prompt (Touch ID / Face ID / Windows Hello / security key). Credentials can be renamed and deleted from the same page; a customer can only manage their own. **Passwordless login** — on the storefront login page a *Sign in with a passkey* button runs `navigator.credentials.get()` with no email (discoverable/resident keys). A valid assertion resolves the credential to its customer and establishes the storefront session. The button renders only when *Allow Passwordless Sign-In* is Yes; with it disabled no passkey button is shown. The `login/options` endpoint also accepts an `email` parameter (email-first, scoped `allowCredentials`), but v1 ships no storefront UI that drives it. Endpoints --------- [](#endpoints) Frontend router `customerpasskey`: CeremonyOptionsVerifyRegistration (logged-in)`customerpasskey/register/options``customerpasskey/register/verify`Authentication`customerpasskey/login/options``customerpasskey/login/verify`Manage`customerpasskey/manage/index`, `.../rename`, `.../delete`Challenges are one-time and stored in the customer session; ceremony endpoints are rate-limited. The authenticator sign counter is persisted and checked on every assertion — a regression is flagged as a possible clone and denied. Themes ------ [](#themes) Ships a Luma template and a Hyvä-compatible variant (`view/frontend/templates/login/passkey-button-hyva.phtml`) that a Hyvä theme wires up by pointing its `customer_account_login` layout at the template. The button renders on `customer_account_login`only when the module is enabled and a usable ceremony is available, so it drops onto an existing login page without assuming it is the only method. Coexistence ----------- [](#coexistence) Standalone: depends only on `magento/framework` + `web-auth/webauthn-lib`. It does **not** use `sso-core` and does **not** depend on `customer-sso`. When both are installed each simply adds its own button to `customer_account_login`, and both resolve to the same `customer_entity` — no shared core, no cross-module dependency. Browser / authenticator support ------------------------------- [](#browser--authenticator-support) Any WebAuthn-capable browser: Chrome, Safari, Firefox, Edge. Authenticators: platform (Touch ID, Face ID, Windows Hello, Android) and cross-platform (FIDO2 security keys). Passwordless requires discoverable-credential support (current browsers + platform authenticators). Tests ----- [](#tests) ``` vendor/bin/phpunit -c Test/Unit/phpunit.xml ``` Real-authenticator flows (Touch ID / security key) are verified manually. License ------- [](#license) [OSL-3.0](LICENSE) © MageDevGroup. Commercial licensing and support: . ### Health Score 38 — LowBetter than 83% of packages Maintenance92 Actively maintained with recent releases Popularity3 Limited adoption so far Community7 Small or concentrated contributor base Maturity42 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~9 days Total 2 Last Release 38d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/6d5acdc656153eb172422ac03f4a59806116de32da5f861c4b00e4ac7bb9c544?d=identicon)[magedevgroup](/maintainers/magedevgroup) --- Top Contributors [![mageown](https://avatars.githubusercontent.com/u/2058487?v=4)](https://github.com/mageown "mageown (2 commits)") ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/magedevgroup-module-customer-passkey/health.svg) ``` [![Health](https://phpackages.com/badges/magedevgroup-module-customer-passkey/health.svg)](https://phpackages.com/packages/magedevgroup-module-customer-passkey) ``` ### Alternatives [craftcms/cms Craft CMS 3.6k3.7M3.5k](/packages/craftcms-cms)[statamic/cms The Statamic CMS Core Package 4.9k3.8M1.2k](/packages/statamic-cms)[jeffgreco13/filament-breezy A custom package for Filament with login flow, profile and teams support. 1.0k2.2M77](/packages/jeffgreco13-filament-breezy)[spatie/laravel-passkeys Use passkeys in your Laravel app 4721.0M49](/packages/spatie-laravel-passkeys)[rawilk/profile-filament-plugin Profile & MFA starter kit for filament. 3915.5k](/packages/rawilk-profile-filament-plugin)[web-auth/webauthn-symfony-bundle FIDO2/Webauthn Security Bundle For Symfony 66587.0k13](/packages/web-auth-webauthn-symfony-bundle) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)