---
title: "Login"
manual: "Passkeys Frontend Authentication"
version: "2.0"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-passkeys-fe:usage-login@2.0"
source: "Usage/Login.rst"
rendered: "2026-09-29T22:18:36+00:00"
---

# Login {#usage-login}

The NrPasskeysFe:Login plugin provides two login flows depending on
site configuration.

## Discoverable login (Variant A) {#discoverable-login-variant-a}

When the browser supports WebAuthn Conditional UI and the site has
no pre-filled username, the login page shows a passkey autofill
option in the username input field. The browser presents available
passkeys matching the site's RP ID without requiring a username.

This is the recommended flow for passkey-only sites.

1.  Open the login page.
1.  The browser automatically suggests a passkey in the username field
    (autofill dropdown).
1.  Select the passkey from the dropdown.
1.  Authenticate with the biometric prompt (TouchID, Windows Hello, etc.).
1.  You are logged in.

## Username-first login (Variant B) {#username-first-login-variant-b}

If the browser does not support Conditional UI, or the user prefers to
type their username first:

1.  Enter your username in the login form.
1.  Click **Sign in with a passkey**.
1.  The browser prompts for your passkey.
1.  Authenticate with the biometric prompt.
1.  You are logged in.

## Password fallback {#password-fallback}

When no passkey is available and the enforcement level allows it,
users can still log in with a password via the standard felogin plugin
or the password fallback link on the passkey login form.

When enforcement level is `required` or `enforced`, users without
a passkey are redirected to the enrollment page after password login.

## Error states {#error-states}

The login form displays user-friendly error messages for:

-   **No passkey found** -- Passkey not registered for this site or
    device.
-   **Authentication cancelled** -- User dismissed the browser prompt.
-   **Challenge expired** -- The challenge timed out (120 seconds by
    default). Try again.
-   **Account locked** -- Too many failed attempts. Wait for the lockout
    to expire or contact an administrator.

## felogin integration {#felogin-integration}

If you use the standard felogin plugin, the extension can inject a
passkey button below the password login form. To enable this, ensure
`nr_passkeys_fe` is active and the felogin plugin is on the same page.

The passkey button is added via a PSR-14 event listener on the
felogin rendering event. The button opens the same WebAuthn flow as
the standalone login plugin.