Usernameless one button sign in

[Feuerhamster]

I want to implement passkeys as a way to log into my app.
The thing is, I want ONLY the passkey to log in. So no username, no email, nothing.
Just one button to click.

I did find discussions about usernameless login, but no exact instructions or examples on how to do it.

Additionally, I do not want separated login and registration flows. I want just one button for the user to click.
The code behind should figure out if a new account has to be registered or if there is already one to log in.
So the log in and registration flow is handled automatically and is from the users perspective pretty much the same.

How to do this?

[MasterKale]

That's a great question @Feuerhamster. I'd summarize this as a request for a "create or get" API method, and you're not alone in wanting something like this. Take a look at this long-standing issue in W3C's Web Authentication Working Group repo over on GitHub:

w3c/webauthn#1568

Unfortunately there's no real solution here for what you want. The only real way to do this is to have one page with "Sign in with passkey" that calls .get() with empty allowCredentials, and below that a separate "Create account" button that calls .create() with some random, unique user.id, and a random user.name that you generate for the user (I'd argue for using something intelligible for user.name to help the user differentiate passkeys for your site if they happen to register multiple ones.)

[wparad]

This is exactly what we ended up doing with Authress federation. However, I will say for the meantime due to all the issues we've run into, I would highly recommend still asking for the email and moving on. Without that, it's really just an unfortunate bad experience for the users 😢

[MasterKale]

I also think it's useful to collect email for a modicum of defense against automated sign up, and for an avenue for account recovery if nothing else.