All posts

Product

·

·

5 min read

Passkeys are ready. Here's how we turned them on by default

What we learned switching passkeys on for 9,000 products, and the fallbacks that kept sign-in working for everyone else.

Portrait of Tobias Lindqvist

Tobias Lindqvist

Co-founder and CTO

an open door in a dark room with light coming in

In September we made passkeys the first step for every new Lintel instance, and existing products could opt in with one toggle. Six weeks later, 41% of sign-ins on instances with passkeys enabled use them, and tickets about forgotten passwords on those instances are down by about a third.

Default on, never mandatory

The biggest decision was what happens when a passkey isn’t available: a borrowed laptop, a browser without platform support, a phone that was just reset. We never hide the other methods. If a passkey fails or the device can’t offer one, the same screen falls back to an email code or a password without an extra click.

That fallback matters more than the passkey itself. A sign-in method that works 95% of the time is a support queue waiting to happen.

Ask after success, not during sign-up

We don’t ask people to create a passkey while they sign up. We ask right after their second successful sign-in, when they already trust the product and the device. Acceptance went from 18% at sign-up to 52% at that later moment.

What you need to do

Nothing, if you use the prebuilt components. If you built your own screens on the headless SDK, update to 4.2 and call startPasskeyEnrollment after a successful sign-in. The migration guide covers both cases.

Open the door.

Free for your first 5,000 users. Live in about four minutes.

Open the door.

Free for your first 5,000 users. Live in about four minutes.

Open the door.

Free for your first 5,000 users. Live in about four minutes.

Create a free website with Framer, the website builder loved by startups, designers and agencies.