---
title: "Usage"
manual: "Passkeys Backend Authentication"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:usage@1.0"
source: "Usage/Index.rst"
rendered: "2026-09-20T16:07:13+00:00"
---

# Usage {#usage}

## Registering a passkey {#registering-a-passkey}

Before you can use passwordless login, you need to register at least
one passkey:

1.  Log in to the TYPO3 backend with your regular password.
1.  Go to **User Settings** (click your avatar in the
    top-right corner).
1.  Find the **Passkeys** section.
1.  Enter a descriptive name in the text field (e.g. "MacBook TouchID"
    or "Office YubiKey"). The default is "Passkey".
1.  Click **Add Passkey**.
1.  Your browser will prompt you to create a passkey using your
    preferred authenticator (TouchID, Windows Hello, YubiKey, etc.).
1.  After successful registration the passkey appears in the list and
    the name input resets for the next registration.

![User Settings page with Passkeys management section](../Images/UserSettings/PasskeyManagement.png)

You can register multiple passkeys for the same account -- for
example, one on your laptop and one on a hardware security key.

## Logging in with a passkey {#logging-in-with-a-passkey}

### Discoverable login (default) {#discoverable-login-default}

With [discoverableLoginEnabled](https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:confval-discoverableloginenabled@1.0) enabled (the default):

1.  Navigate to the TYPO3 backend login page.
1.  The browser may automatically show available passkeys in an
    autofill dropdown (Conditional UI).
1.  Select your passkey.
1.  Verify with your authenticator.
1.  You are logged in without typing a username.

> [!NOTE]
> Discoverable login requires that the passkey was registered as a
> *resident credential* (stored on the authenticator). Most modern
> authenticators do this by default.

### Username-first flow {#username-first-flow}

When [discoverableLoginEnabled](https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:confval-discoverableloginenabled@1.0) is set to `false`:

1.  Navigate to the TYPO3 backend login page.
1.  Enter your **username**.
1.  Click **Sign in with a passkey**.
1.  Your browser will prompt you to verify with your authenticator.
1.  Upon successful verification, you are logged in.

![Login form with username filled and passkey button ready](../Images/Login/LoginPageUsernameFirst.png)

### Error handling {#error-handling}

If a passkey login fails (for example, the server cannot verify the
assertion), a passkey-specific error message is shown on the login
page:

![Login form showing passkey authentication failed error](../Images/Login/LoginPagePasskeyError.png)

> [!NOTE]
> A passkey is itself multi-factor (device possession plus a biometric or
> PIN), so by default the extension **skips** TYPO3's additional MFA challenge
> after a successful passkey login. This is controlled by the
> `skipMfaOnPasskeyAuth` setting, which is enabled by default. If an
> administrator disables it, you will also complete TYPO3's MFA verification
> after passkey authentication. Password logins are unaffected and always
> follow TYPO3's MFA configuration.

## Managing your passkeys {#managing-your-passkeys}

In **User Settings > Passkeys**, you can:

-   **View** all your registered passkeys with their labels, creation
    dates, and last-used timestamps.
-   **Rename** a passkey by clicking its label and entering a new name
    (max 128 characters).
-   **Remove** a passkey you no longer need.

> [!IMPORTANT]
> If [disablePasswordLogin](https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:confval-disablepasswordlogin@1.0) is enabled, you cannot remove
> your last remaining passkey. This prevents you from locking
> yourself out of the system.

## Fallback to password login {#fallback-to-password-login}

By default, password login remains available. If a user does not have
a passkey registered or their authenticator is unavailable, they can
still log in with their regular TYPO3 password.

This fallback can be disabled with the
[disablePasswordLogin](https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:confval-disablepasswordlogin@1.0) setting.

## When passkey setup is required {#when-passkey-setup-is-required}

Your administrator may configure passkey enforcement for your user group.
When this happens, you will see an interstitial page after logging in that
prompts you to register a passkey.

The interstitial page explains the benefits of passkeys and offers two options:

-   **Set up now** -- Takes you directly to
    **User Settings > Passkeys** where you can register a passkey
    (see [Usage](https://docs.typo3.org/permalink/netresearch/nr-passkeys-be:usage@1.0) above).
-   **Skip for now** -- Dismisses the prompt for the current session.
    This option is only available during the grace period.

> [!NOTE]
> The grace period is a window (e.g. 14 days) set by your administrator.
> During this time, you can skip the setup prompt and continue working.
> A countdown shows how many days remain: *"You have N days remaining to
> set up your passkey."*

Once the grace period expires, the **Skip for now** option disappears
and you must register a passkey before you can access the TYPO3 backend.

> [!TIP]
> Register your passkey early, even during the grace period. Passkeys
> provide stronger security than passwords and make logging in faster --
> a single touch or glance replaces typing a password.

If your group's enforcement level is set to **Enforced**, there is no grace
period at all. The setup prompt appears immediately after login and cannot be
skipped.