Usernameless one button sign in

[Feuerhamster]

I want to implement passkeys as a way to log into my app.
The thing is, I want ONLY the passkey to log in. So no username, no email, nothing.
Just one button to click.

I did find discussions about usernameless login, but no exact instructions or examples on how to do it.

Additionally, I do not want separated login and registration flows. I want just one button for the user to click.
The code behind should figure out if a new account has to be registered or if there is already one to log in.
So the log in and registration flow is handled automatically and is from the users perspective pretty much the same.

How to do this?

[MasterKale]

That's a great question @Feuerhamster. I'd summarize this as a request for a "create or get" API method, and you're not alone in wanting something like this. Take a look at this long-standing issue in W3C's Web Authentication Working Group repo over on GitHub:

w3c/webauthn#1568

Unfortunately there's no real solution here for what you want. The only real way to do this is to have one page with "Sign in with passkey" that calls .get() with empty allowCredentials, and below that a separate "Create account" button that calls .create() with some random, unique user.id, and a random user.name that you generate for the user (I'd argue for using something intelligible for user.name to help the user differentiate passkeys for your site if they happen to register multiple ones.)

[wparad]

This is exactly what we ended up doing with Authress federation. However, I will say for the meantime due to all the issues we've run into, I would highly recommend still asking for the email and moving on. Without that, it's really just an unfortunate bad experience for the users 😢

[MasterKale]

I also think it's useful to collect email for a modicum of defense against automated sign up, and for an avenue for account recovery if nothing else.

[witwaycorp]

Curious about the guidance/best practice for account recovery with Webauthn. Thanks.

[Feuerhamster]

@MasterKale
Thank you for your answer. I am now finished with my implementation, and it works pretty well. I've decided to do a separate registration after all where the user only has to enter a username and the ID is generated randomly.

I've wanted to have a one-button-click solution because the app I am building is for families and potentially elder people. In the past, some users tried to argue with me over why an account registration is needed at all and that they do not want to register anywhere. These people didn't really understand that it's technically necessary because the app has to know somehow which data belongs to which person.

In the past, I had a standard username/password login. But I quickly learned that login with username and password is actually an unreasonable demand and bad UX for a lot of average users who doesn't know much about tech.
So I removed username/password completely and added OAuth with Google. It was a lot better because most people were using my App on Android smartphones, where the Google account is automatically linked in the browser. But some people still had issues on devices where there is no google account automatically linked, or they didn't even know what a Google account is, neither they knew their credentials for that. And some of my programmer friends mentioned that Google as only login method is pretty questionable because of privacy and big tech corp stuff.

Now, passkeys are an additional login method and I hid a lot of that stuff behind a good UI that everyone should understand. Its pretty awesome because it's extremely easy for users who dont know much about tech. But also great for tech savy users as they now can log in with hardware security keys for example.

Thank you very much for your Library, it helped me a lot implementing this stuff ❤️