Passkey Authentication Service  ·  View 04 of 21  ·  People and journeys

Journey — Enrolling a First Passkey

Five phases from the offer to the insurance, and the question nobody answers in the middle.

Editable source SVG draw.io All views
Everyday user on a phone, mid-login Goal — Stop typing a password without taking on a new chore Trigger — Offered right after a successful password login Done when — A working passkey, and a second way back in 1 · Offered after the password 2 · Decides 3 · Creates ◆ moment of truth 4 · Confirms 5 · Insures ◆ moment of truth What they do Sees the offer Asks what it replaces Face or fingerprint Names the device Stores a recovery code What the platform does Offers once per login Sends excludeCredentials Verifies attestation Records the verdict Demands a second route How it feels Reassured Fine Uneasy Where it hurts No answer to "what if I lose it" The code goes in a drawer What answers it Second-route prompt is mandatory Device list is human-readable Cooling-off on the new credential Journey — The Everyday User Enrols a First Passkey The trough is not the biometric. It is the unanswered question about loss, which is why section 3 refuses a silent single-credential account. v 1.0 · owner Security & Identity Architecture · date 2026-10

The finding

  • The trough is not the biometric prompt, which users find easy. It is the unanswered "what happens if I lose this phone", which arrives before any credential exists and has no good answer at that moment.
  • That is why registration requires either a second credential or an explicit acknowledgement of the risk: the architecture answers the trough instead of the copywriting.
  • The offer is made after a successful password login rather than at account creation, because that is the only moment the user has already proved who they are.

What the set answers it with

  • Mandatory second-route prompt at enrolment (view 14, ADR-07).
  • A human-readable device list, so the user can see what they have (view 08).
  • A cooling-off window on a credential enrolled through recovery, so an account takeover cannot immediately evict the owner (view 15, ADR-08).

Assumptions

  • Registration finalisation p99 120 ms, dominated by attestation verification.
  • Recovery codes are shown once and are assumed to be stored badly by most users, which is why they are classified as medium assurance rather than high.
◀  Actors and Their Core Journeys All views Journey — The User Who Has Lost Every Device  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Security & Identity Architecture · 2026-1004-journey-enrol