Passkeys as a second factor

Users can now use a passkey as their second factor for multi-factor authentication after they sign in another way. A passkey combines two factors, a device and a PIN or biometric, in one step.

When users sign in with a password, a social connection, or a reset-password code, they can use their passkey instead of an SMS code or authenticator app, including during reverification. In <SignIn /> and the reverification modal, users who have a passkey start on the passkey step and can pick another method with Use another method.

This also helps with recovery. A user who loses their phone or authenticator app can sign in with their password and use their passkey as their second factor, without waiting for an MFA reset.

A passkey doesn't turn on MFA for a user. Clerk doesn't prompt users who haven't set up MFA for a separate second factor. If you require MFA, those users must set up a second factor before sign-in finishes, including when they sign in with a passkey.

Get started

Native apps need clerk-ios 1.5.0, clerk-android 1.1.4, @clerk/expo 4.13.1, or later. Web apps need @clerk/clerk-js 6.40.0 and @clerk/ui 1.41.0 or later: upgrade your SDK to the minimum version in the versioning guide, and if you pin either package or bundle @clerk/ui, upgrade it too.

Then:

1. If your application was created before July 8, 2026, turn on Passkeys satisfy multi-factor authentication under Sign-in with passkey on the User & authentication⁠ page. Newer applications already have it on, and native apps offer the passkey second factor once it's on.
2. For web apps, opt in to the Passkeys as a second factor on the web update on the Updates⁠ page if your instance doesn't have it. Instances created on or after October 19, 2026 already have it, except production instances cloned from a development instance without it.

If you're building a custom flow, supportedSecondFactors can now include passkey. See the custom MFA flow guide to complete it, and the passkeys and MFA guide for SDK requirements.