Supabase Launches Passkey Authentication in Beta for All Projects.

Supabase has released passkey authentication in beta, giving developers a passwordless, phishing-resistant way to authenticate users across all projects. The feature supports biometric sign-in through Face ID, Touch ID, and Windows Hello, as well as device PINs and hardware security keys.

The update, announced via its changelog, eliminates the need for users to manage passwords while maintaining security through the WebAuthn standard. Supabase Auth stores only the public key for verification; private key material remains on the user's device or credential provider.

Each passkey enrollment or sign-in involves a three-step WebAuthn ceremony. First, the client requests a challenge from Supabase Auth. The browser then invokes navigator.credentials.create() for registration or navigator.credentials.get() for sign-in, prompting the user to approve with biometrics or a security key. Finally, the signed response is sent back to Supabase Auth, which validates the challenge and either stores the new credential or issues a session.

Supabase uses discoverable credentials, meaning users don't need to type an email or username. The authenticator resolves the account from the credential it already stores.

Developers can enable passkeys through the Dashboard under Authentication → Passkeys. The setup requires three WebAuthn relying party details: a display name shown during the passkey prompt, a relying party ID (the bare domain without scheme or port), and up to five allowed origins.

The Dashboard pre-fills these fields from the project's Site URL and name. Teams can also configure passkeys through the CLI or Management API.

The Passkeys API is currently experimental and requires an explicit opt-in when creating the Supabase client. Developers must pass experimental: { passkey: true } in the auth configuration object.

Registering a passkey for an authenticated user involves calling the appropriate method from the @supabase/supabase-js client library. This typically happens after initial account creation with another auth method, allowing users to add a passkey for future sign-ins.

The beta release follows Supabase's recent focus on modernizing authentication workflows, including ISO 27001 certification and improved security practices. The passkey feature is available immediately to all projects, though the experimental API may change without notice during the beta phase.