PHPackages magemate/magento-admin-passkey - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. magemate/magento-admin-passkey ActiveMagento2-module[Authentication & Authorization](/categories/authentication) magemate/magento-admin-passkey ============================== Passwordless / WebAuthn (FIDO2 passkey) authentication for the Magento 2 admin v1.0.0(1mo ago)001OSL-3.0PHPPHP ~8.3.0 Since Jul 2Pushed 1mo agoCompare [ Source](https://github.com/MageMate/magento-admin-passkey)[ Packagist](https://packagist.org/packages/magemate/magento-admin-passkey)[ RSS](/packages/magemate-magento-admin-passkey/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependencies (7)Versions (2)Used By (0) MageMate\_AdminPasskey ====================== [](#magemate_adminpasskey) Passwordless / WebAuthn (FIDO2 **passkey**) authentication for the Magento 2 backend (admin). Overview -------- [](#overview) `MageMate_AdminPasskey` adds passkey authentication to the Magento admin. Admin users can register one or more passkeys after a normal login and manage them (list, rename, delete), then sign in with a **"Sign in with a passkey"** button on the admin login form via the browser WebAuthn API (discoverable credentials — no username typing). Store owners can, via System Configuration (`Security` tab → `adminpasskey`section): - **Force** users to set up a passkey after a normal login. - Set a **maximum validity** (lifetime) for a passkey. - **Disallow normal (password) login** for users who already have an active passkey. Security-first is the guiding principle — this module touches admin authentication, the highest-value attack surface in the store. Installation ------------ [](#installation) The module lives at `package-source/magemate/magento-admin-passkey` and is wired into the root `composer.json` as a `path` repository. ``` composer update magemate/magento-admin-passkey bin/magento module:enable MageMate_AdminPasskey bin/magento setup:upgrade bin/magento setup:di:compile # required — registers the CLI command + interceptors bin/magento cache:flush ``` The module is **disabled on first install** — enable it explicitly. After adding or changing DI (plugins, console commands) re-run `setup:di:compile`; a compiled env will not surface new wiring on `cache:flush` alone. Configuration ------------- [](#configuration) **Stores → Configuration → Security → Passkey** (`adminpasskey/general`). All defaults are security-first (feature off, UV required): FieldPathDefaultEffectEnable passkey login`enabled``0`Master switch for every passkey entry point.Force passkey setup after login`force_setup``0`Redirect admins with no active passkey to the register page.Disallow password login`disallow_password_login``0`Block password sign-in for admins who own an active passkey.Max passkey validity (days)`passkey_max_validity_days``0`Sets `expires_at` at registration; `0` = never expires.Require user verification`require_user_verification``1`Enforce the WebAuthn `UV` flag (PIN/biometric).Passkey satisfies 2FA`satisfies_2fa``1`A passkey login grants the Two-Factor-Auth session.Relying Party ID / Name`rp_id` / `rp_name`derivedOverride the WebAuthn RP id/name (defaults from the admin base URL).### Usage [](#usage) - **Register**: System → Other Settings → *Register a passkey* (after a normal login). - **Manage**: System → Other Settings → *Admin Passkeys* (list / rename / delete; own passkeys always, all users' passkeys with `manage_all`). - **Sign in**: the **Sign in with a passkey** button on the admin login form (discoverable credential — no username typed). - **Recovery (lockout)**: `bin/magento security:passkey:recover `deactivates that admin's passkeys, re-opening password login for them. Security notes -------------- [](#security-notes) This module is on the admin authentication path — the store's highest-value attack surface. The security posture (see PRD §6 and [`docs/DECISIONS.md`](docs/DECISIONS.md)): - **Ceremony verification (server-side).** Every assertion/attestation is checked for origin, RP-ID hash, single-use challenge, WebAuthn `UP`/`UV` flags, and an ES256/RS256 signature. `signCount` must increase monotonically — a non-increasing count is treated as a cloned authenticator and rejected. - **Anti-enumeration.** Passwordless login uses **discoverable credentials** (no username is typed or leaked). Every verification failure collapses to one generic `WebauthnException` with uniform response shape, so the endpoints never reveal whether a user or credential exists. - **Single-use, bound challenges.** Challenges are stored server-side, read-and- cleared before verification (one shot). The registration challenge is pinned to the `user_id`; the pre-auth login options endpoint is rate-limited per IP. - **CSRF.** Authenticated endpoints use Magento form keys; the pre-auth endpoints are protected by the single-use server challenge binding + rate limiting. - **Key storage.** Only **public** keys are stored — never private key material. Credential IDs are unique (DB constraint) and `expires_at` is enforced on every read path. AAGUID is stored best-effort only (`attestation: none`, privacy). - **No policy weakening by default.** Password and TFA policy are only relaxed when explicitly configured (`disallow_password_login`, `satisfies_2fa`). Lost/broken authenticators are recovered per-user via the CLI, never a global bypass window. - **Adobe IMS.** When Adobe IMS owns admin login, all passkey features auto-disable (single `FeatureAvailability` gate) and an admin notice explains why. - **No secrets in logs.** Login attempts are recorded via the standard `backend_auth_user_login_*` events / admin action log; no key material is logged. Documentation ------------- [](#documentation) - [`docs/DECISIONS.md`](docs/DECISIONS.md) — design decisions D1–D9. - [`docs/IMPLEMENTATION_LOG.md`](docs/IMPLEMENTATION_LOG.md) — per-story build log. - [`docs/QA_REPORT.md`](docs/QA_REPORT.md) — quality-gate results. Layout ------ [](#layout) ``` magento-admin-passkey/ ├── composer.json # magemate/magento-admin-passkey (magento2-module) ├── README.md ├── docs/ # DECISIONS.md, IMPLEMENTATION_LOG.md, QA_REPORT.md ├── src/ # PSR-4 MageMate\AdminPasskey\ │ ├── registration.php # registers MageMate_AdminPasskey │ ├── etc/ # module.xml, di.xml, acl.xml, db_schema, system.xml, … │ ├── Api/ Model/ Controller/ Block/ Observer/ Plugin/ Console/ Ui/ │ └── view/adminhtml/ # layout, templates, ui_component, web/js (ceremonies) └── tests/ # PSR-4 MageMate\AdminPasskey\Test\ (Unit + Integration) ``` Module dependencies ------------------- [](#module-dependencies) Declared via `` in `src/etc/module.xml`: - `Magento_Backend` - `Magento_User` - `Magento_Authorization` - `Magento_Config` - `Magento_Ui` Development ----------- [](#development) - PHP 8.3, PSR-12, Magento 2 coding standards + PHPMD ruleset. - Constructor DI only — no `new ClassName()` in app flow, no hand-written factories. - Never edit core; integrate via plugins / observers / preferences. - Integration tests live inside the module (`tests/Integration`). ### Health Score 38 — LowBetter than 83% of packages Maintenance90 Actively maintained with recent releases Popularity1 Limited adoption so far Community7 Small or concentrated contributor base Maturity48 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 48d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/299192393?v=4)[magemate](/maintainers/magemate)[@MageMate](https://github.com/MageMate) --- Top Contributors [![henkvalk](https://avatars.githubusercontent.com/u/8955854?v=4)](https://github.com/henkvalk "henkvalk (15 commits)") ### Embed Badge ![Health badge](/badges/magemate-magento-admin-passkey/health.svg) ``` [![Health](https://phpackages.com/badges/magemate-magento-admin-passkey/health.svg)](https://phpackages.com/packages/magemate-magento-admin-passkey) ``` ### Alternatives [mollie/magento2 Mollie Payment Module for Magento 2 1142.0M17](/packages/mollie-magento2)[dotdigital/dotdigital-magento2-extension Dotdigital for Magento 2 50406.2k23](/packages/dotdigital-dotdigital-magento2-extension)[buckaroo/magento2 Buckaroo Magento 2 extension 32426.0k8](/packages/buckaroo-magento2)[loki/magento2-components Core module for defining Alpine.js components with advanced AJAX features 1015.1k29](/packages/loki-magento2-components)[zwernemann/module-withdrawal Magento 2 EU Withdrawal Button Module - Adds a withdrawal/revocation button for orders in compliance with EU Directive (EU) 2023/2673 2610.9k2](/packages/zwernemann-module-withdrawal) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)